Piracy hits a brief pause, but web of leaks still unbroken
For Telugu cinema, 2025 was the year of split screens, with brilliant highs at the box office on one side and a murky underworld of leaks, hacks and digital theft on the other. While some films took off and others went bust, the real plot unfolded far away from theatres.
Behind the scenes, a coordinated and sustained effort by the Telangana police, the Indian Cyber Crime Coordination Center (I4C) and the Telugu Film Chamber of Commerce’s Anti-Video Piracy Cell (AVPC) has quietly laid siege to the industry’s most elusive hackers.
As the network narrowed, many key operators had been tracked down and cornered, including Cyril Raja Amaladoss, who pushed new releases to multiple syndicates, and then there was a more notorious name in circulation: iBomma’s Ravi Emandi.
On October 17, after tracking his movements for months, Telangana police finally caught Ravi while he was visiting Hyderabad. According to police, he ran a piracy network built around iBomma, Bappam TV and more than 65 mirror websites that hosted crisp, high-definition (HD) prints of upcoming Telugu movies. The scale was staggering: hard drives containing 21,000 films in different languages were seized, and police estimate that Ravi made around £20 million from the operation; This money was allegedly transferred to flats and land. Bank accounts worth Rs 3.5 crore have now been frozen.
But the piracy itself was only the opening act. As police dug deeper, they found a darker layer: Users who streamed pirated movies on iBomma and its mirror pages were being quietly directed to betting platforms, a pipeline that enabled identity theft, data mining and financial fraud.
Two of Ravi’s business partners – web developer Duddela Shivajee and Susarla Prashanth – were arrested in September. Ravi is also among four other FIRs involving hacking, online cheating and data theft.
His arrest added to a series of earlier breakthroughs. In September, the cybercrime wing had nabbed five people: Ashwani Kumar from Bihar, the ringleader who allegedly hacked servers of digital media companies to steal HD prints of new movies; Cyril Infant Raj from Tamil Nadu is believed to be running piracy websites like 1TamilBlasters and has uploaded over 500 movies through international servers since 2020 and earned around Rs 2 crore in cryptocurrency; Jana Kiran Kumar from Hyderabad was accused of recording over 100 movies in theaters using hidden mobile devices; Sudhakaran from Erode, who admitted to recording 35 South Indian works; and Arsalan Ahmed, who allegedly uploaded the films to file-sharing platforms and distributed them through Telegram channels.
A decisive move
The wave of arrests and ongoing crackdown on piracy follows new triggers. AVPC had filed complaint after Telugu films #Single And HIT: Third Case It surfaced online the same day they were published, and was quickly followed by a similar leak of information. Kuberaa. Each incident renewed pressure on enforcement, signaling that pirates were becoming bolder and more sophisticated.
According to the researchers, the syndicates thrived behind layers of digital camouflage: encrypted Telegram groups, offshore domain hosting servers, and cryptocurrency payment routes that blurred their jurisdictional footprint.
The latest arrests have injected some hope into the industry, but the fight is not over yet. For every iBomma or 1TamilBlasters shut down, there are several more hydra-like networks at work waiting to fill the gap.
AVPC pegged the industry’s revenue loss in 2024 due to piracy at ₹3,700 crore. The loss estimate for 2025 will be made by the end of the year, but chairman Rajkumar Akella is hopeful that the figures may come down this time.
“Fighting piracy is a long-term and ongoing struggle,” he says. “Various fake websites such as 1Tamilmv, Movierulz, Tamilrockers and CineVood continue to thrive. The latest arrests have shown that if all our efforts continue, there will be results.”
Including pirated links of new versions Andhra King Taluka And Tere Ishk Mein, Rajkumar notes that continuing to pop up online is a faint silver lining. Many of these prints are no longer very sharp HD versions. Previous movie events, e.g. HIT 3, Single And Kuberaa, The industry was shaken by the movie appearing online on or before the day of its release, but now downloads are coming online almost two days after the movie hits theaters. “Still, it’s worrying,” he admits.
It looks like the rope is tightening. Rajkumar says that with the Telangana police coordinating with I4C, the industry started seeing a measurable impact: “The police alerted us to certain leakage points and we upgraded standard operating procedures for digital cinema suppliers to plug these loopholes. This has helped. Also, apart from an incident at Dharmavaram in Anantapur district, there have been no reported cases of new movies being pirated with camcorders in cinema halls in the two Telugu States in the last two months.”
But the road does not end within regional borders. New hacking links recovered from footage have been traced to Gujarat, Tamil Nadu and other states, often in remote locations where security measures are lax.
Unlike the pre-digital era, when preventing hacking meant tracking down lone operators, recent arrests have helped expose the workings of large-scale networks.
How did it all start?
The vast network of digital piracy was first revealed during the release of: Baahubali 2 Rajkumar recalls how the case of Priyank Paradeshi, a San Francisco-based IT worker, revealed the extent of a distributed, cross-border operation. While Paradeshi was reportedly working with partners who recorded films on cameras in Calcutta, another member of the network also threatened Indian film production companies, demanding huge payments to prevent future films from being leaked.
“This was when we could still track IP addresses, before hackers started masking them,” says Rajkumar. “We followed the trail to Jabalpur and Pune. Transactions were being carried out using cryptocurrency even in 2017. This showed us the complexity of the problem. At that time, jurisdictional challenges made it difficult to catch criminals in different geographical locations.”
He says Home Office-backed I4C is helping to close these gaps.
To put things in proper perspective, he points out the case of iBomma Ravi, who was arrested when he briefly visited Hyderabad. “If he lives in France and is outsourcing his work to the Caribbean Islands, how do we catch him without the help of local authorities?”
Investigations revealed the size of Ravi’s operation: the iBomma and Bappam domains were run by employees in the Caribbean and the United Kingdom. According to the police, Ravi admitted that he purchased the movies through the Telegram app and uploaded them to the domains. It also recorded movies from OTT platforms and converted them to HD quality through a multi-layer, automatically generated mirror transmission system. The servers supporting the network were operated from the Netherlands and Switzerland.
Investigators found that Ravi initially registered the iBomma domain through a company called Njalla with his own email ID, debit card and personal information. The site was then hosted on IPVolume, which provided the backend infrastructure. The underlying script redirected users who clicked on movie links to online gaming and illegal betting platforms before granting them access to the pirated movie.
Transnational multiple crime
Long dismissed as a “victimless crime,” piracy was rarely seen as serious enough to warrant the intervention of cross-border law enforcement. But as Rajkumar describes it, hacking has now evolved into “international polycrime,” a widening nexus that intersects with betting companies, identity theft and malware attacks, forcing global institutions to take notice.
In July, the Digital Piracy Conference at the Indian Business School, Hyderabad, attended by officials from the Central Bureau of Investigation and Interpol, focused on the growing link between hacking and cybercrime. The arrest of iBomma Ravi and subsequent revelations of how the site exposed users’ financial and identity data to betting networks and fraud portals is an example of this. “Anyone who argues that watching movies on pirated websites does no harm needs to understand that movie piracy is just a show; identity theft and malware affect every user,” says a producer who works closely with AVPC.
Producer Sureshbabu also agrees. “It’s good that the government is helping us fight piracy. The bigger issue is to make people realize the seriousness of the problem. Apart from producers being harmed, their privacy is also being compromised.”
These concerns were also echoed internationally. Rajkumar says the need for global enforcement agencies to stay connected and exchange information for actionable intelligence was a key theme at the Interpol Global Digital Piracy Meeting held in Seoul, Korea, on November 17 and 18. “If cinema is going global, so is piracy.”
Hacking and malware
In 2021, crypto mining malware was discovered embedded in pirated downloads. Spider-Man: No Way Homeendangering both individual devices and corporate networks.
“The fact that just one hacker organization (iBomma) earns around 25 lakh a month shows the magnitude of the problem. Networked betting apps benefit from traffic to the piracy site,” Rajkumar reiterates.
On November 27, the Telugu film industry, with the help of the Telangana government, signed a memorandum of understanding with Japanese film and anime organization CODA (Content Overseas Distribution Association) to strengthen the protection of intellectual property and take countermeasures against online copyright infringements. The MoU holds significance considering the growing popularity of Japanese anime in India.
The bigger challenge now, according to Rajkumar, is to hold intermediaries, such as web hosting companies, accountable. “When pirated links appear, complaints are made to the hosting domains and it takes 24 to 36 hours for the links to be removed. By then, the damage will be done as hundreds of mirror websites will already have these links. We are developing tools to escalate the issue to the hosting domains in real time.”
