Allegedly stealing brain station penetration test data by illegally accessing the server and selling it on the dark web

The software company 'Brain Station 23' accused of corruption and money laundering in government projects has been accused of data theft. The company has been accused of accessing sensitive digital infrastructure of various organizations without permission in the name of cyber security and illegally collecting information in the name of identifying security vulnerabilities by its cyber security department 'CyberStation'.

Questions have also been raised as to whether Brain Station has accessed the websites of sensitive government departments. At the same time, as a result of intrusion like this without permission, the information of any organization can be sold on the dark web - many have also expressed the fear. In the name of unauthorized penetration testing, such intrusions are termed as 'cyber crime' and 'illegal hacking' by leading technology and legal experts of the country.

According to reports, Brain Station 23 has launched a new cyber security unit called 'CyberStation'. It is alleged that the personnel of this team are conducting unauthorized penetration drives in various government and private institutions. According to technology experts, penetration testing and dark web monitoring are two completely different processes.

What happens behind the scenes of penetration testing: According to the complaint, security tests are conducted on the software or web-based systems of the concerned organizations without their prior permission. The organizations are then informed about the identified vulnerabilities and offered to take up commercial penetration testing services. A serious complaint is that if an organization is not interested in adopting this service, its security vulnerabilities are exposed.

More serious allegations have also raised concerns in the tech sector that if companies do not respond to these fraudulent offers, their secret security vulnerabilities are being exposed and sold on the dark web. And sometimes there is no logical explanation of how the Brain Station secures this sensitive information, even with permission.

According to the complaint of one such organization which came to Kalbela's hands, the brain station suddenly gave us a message. The message says that your site has a vulnerability. At the same time they want to do business with us. But we had no contract with them, they entered the site without our permission and found out the vulnerability, it is unfair.

Merely reporting security vulnerabilities or offering services to an organization is not a crime in itself. The key questions in this case are three—whether the organization involved gave permission, what kind of testing was actually conducted, and whether there was any commercial pressure or threat associated with the disclosure of the security vulnerability.

Brain Station 23's Cyber ​​Security Division has publicly stated that CyberStation offers penetration testing, offensive security, security monitoring, and a variety of other cyber security services. The recruitment notification of the company also mentions the recruitment of personnel with skills in penetration testing and security vulnerability detection of web applications, APIs and mobile applications.

Brain Station's activities have raised new questions about the operations, professional ethics and legal accountability of cyber security service providers in the IT sector in Bangladesh. As a result, there is a demand for necessary digital forensic investigation with technical audit to verify the damage to the country and citizens with in-depth technical evidence regarding these complaints.

Penetration testing is a legitimate process in cyber security, a veteran of the technology sector told Kalbela. However, in order to conduct penetration testing or security audit, there must be a written agreement and prior permission with the concerned organization. Accessing digital systems without permission is a gross violation of cyber principles and resembles the behavior of hackers.

He said, the main purpose of finding security vulnerabilities should be to protect the concerned organization, it is never acceptable to make it a tool to sell services commercially. Just as one cannot gain unauthorized access to a private wall by showing the vulnerability of a security guard and force them to buy a security product or service, it is impermissible and unfair to enter someone's digital infrastructure without permission and make a business proposal, which no one has the moral authority to do.

Penetration testing is an accepted method in the cyber security sector, say cyber security analysts. Through this, the security vulnerabilities of an organization's software, servers, network and digital infrastructure are identified. But the basic condition of this process is proper authorization and determination of the specific scope of the test. Accessing an organization's systems without permission, bypassing security controls, or attempting to collect sensitive information can create serious legal questions and security risks.

Cyber ​​security expert Arif Moinuddin told Kalbela that penetration testing is a process of finding the vulnerability of a particular system. However, this test is only legally and ethically valid with the prior permission of the concerned institution. Identifying vulnerabilities by accessing systems without permission is outright illegal and constitutes hacking and cyber crime. It is completely unethical practice to enter the system without permission and then offer business and such practice also creates the possibility of selling information on the dark web. Selling or fraudulently using information obtained through unauthorized means is a cyber crime.

What the Bangladesh Cyber ​​Law Says: Section 17 of the Bangladesh Cyber ​​Security Act, 2026 provides for penalties for illegal access to critical information infrastructure and certain types of hacking activities. The Act also contains provisions relating to unauthorized access and damage to information systems. The law clearly states that it is a criminal offense to intrude and damage any IT infrastructure without prior permission.

According to lawyers, if a cyber security company hacks into another organization's system without permission, takes data or threatens to exploit vulnerabilities for commercial gain, it would be considered extortion, intimidation and data theft. In that case, there is an opportunity to directly arrest and file a criminal case against the company and its associated officials under various sections of the law.

Cyber ​​security expert and International Criminal Tribunal prosecutor Tanveer Hasan Joha told Kalbela that monitoring the dark web and reporting previously leaked information to relevant institutions is a legitimate approach. The normal process is that you enter into an agreement with the organization. You can do it if they give permission. However, accessing someone's database or live system without permission is a marked criminal offense under any law in the world, punishable by imprisonment.

The most worrying thing, he said, is that there is a risk of cybercriminals from among those involved in such activities, who can sell sensitive information of any organization on the dark web, with or without permission. If Brain Station's engineers are involved in these unauthorized intrusions or crimes, the possibility of their association with darkweb hackers cannot be ruled out.

This is not the first complaint against Brain Station, recently a case has been filed against this institution in the Anti-Corruption Commission (ACC) on allegations of irregularities and corruption in a government project. ACC filed a case based on the information of irregularities in the 'Covid-19 Emergency Response and Pandemic Preparedness (ERPP)' project of the Directorate of Health. Raisul Kabir, owner of Brain Station 23 Limited, is also an accused in that case. And Brain Station is the only IT software company against whom the ACC has filed a case.

Apart from this, the name of Brain Station 23 was always accused as one of the secret channels of money laundering of various individuals of the Awami League government. One of the investors in Brain Station is also accused of money laundering and capital market manipulation. It has been found that the owner of the much talked about Genex Infosys Mohammad Adnan Imam is one of the investors of Brain Station. Recently, Adnan Imam has been banned from leaving the country by the court on the charges of 2000 crores of money laundering and capital market manipulation. Adnan Imam, a dual citizen of Bangladesh and the United Kingdom, is the chairman of the executive committee of NRBC Bank, who is extremely controversial due to allegations of unprecedented corruption. Awami League government gave him CIP status as a 'remittance warrior'.

Allegedly, this Adnan, known as a 'white collar criminal' among looters of the financial sector, has stolen more than 2 thousand crore rupees from various banks in just 3 years. Kaguje opened a company and smuggled it abroad with a loan of hundreds of crores of rupees. The Anti-Corruption Commission (ACC) has also written to the UK's National Crime Agency to seize his assets. It is also alleged that this huge amount of controversial money of Adnan Imam was invested in Brain Station.

When asked about the complaint, the owner of the establishment, Raisul Kabir, requested this reporter to send a written question. A written query was sent to him at his request, which has not been answered till the time of writing this report. Later he sent a return message asking for two days to send a reply.

But before sending the question, I talked to Raisul Kabir on the phone. Then he said that a new team called 'Cyber ​​Station' is working for penetration testing. He directly acknowledged this unauthorized intrusion as 'unfair, immoral and totally unacceptable'.

Raisul Kabir said that no one should enter the system without permission. If our cyber station team is carrying out such activities without permission, it is highly unethical. I will seriously investigate the matter internally and necessary action will be taken.

Referring to the ACC case, he said, we completed the work at the lowest cost; But still I don't know why the case against us.

When asked about Adnan Imam's investment, he said, Adnan Imam had investment, but now he has no investment, he has already left.