Threat Atlas India

Visual explainers on threats, attackers and the rules Indian organisations must follow when they get hit. Every number links back to its source.

This week

Last 12 weeks

Counts of Indian organisations newly posted on ransomware leak sites, from ransomware.live. Names are never shown. Updated every Monday.

The four clocks

In India, one cyber incident can start several legal reporting deadlines at once. Each clock starts when the organisation notices the incident. Pick an organisation type, then drag time forward.

Who was hit
T+6h

Hard deadline "Without delay", no fixed hour Shaded bar: RBI's 2 to 6 hour window Time axis is stretched in the first 24 hours.

Verified against official texts: CERT-In Directions No. 20(3)/2022, para (ii); RBI Cyber Security Framework in Banks (2 Jun 2016), Annex-3; RBI Master Directions for non-bank Payment System Operators (30 Jul 2024), para 22.4; SEBI CSCRF (20 Aug 2024), Annexure-O B.1; DPDP Rules 2025, G.S.R. 846(E), Rule 7 (in force from 13 May 2027). This is an explainer, not legal advice.

Who do you tell?

Three incidents at three Indian organisations. For each statement, decide whether it is a legal requirement. The answer and its source appear as soon as you choose.

0 / 0 answered

Made for India

Most attacks on Indian organisations use the same tools seen worldwide. These six stand out because they are built around India's own systems: government apps, recruitment, traffic fines, UPI and the police. Filter by who gets targeted.

EspionageTransparent Tribe (APT36)

The fake Kavach app

Why it's Indian: Kavach is the government's own two-factor login app, built by the National Informatics Centre. Officials must install it, so a fake installer looks routine.

  1. Attackers clone Indian government websites, such as a defence officers' institute.
  2. The download gives a working Kavach installer bundled with malware.
  3. CrimsonRAT then gives remote control, with a keylogger.
T1036 MasqueradingT1204.002 Malicious file

Source: Cisco Talos, reported by BleepingComputer, 29 Mar 2022. The group has targeted Kavach since early 2022.

EspionageTransparent Tribe (APT36)

Malware for BOSS Linux

Why it's Indian: it targets BOSS (Bharat Operating System Solutions), an Indian-made Linux system used in parts of the government, alongside Windows.

  1. A phishing email carries a "meeting letter" that looks like a PDF but is a Linux .desktop shortcut.
  2. Opening it shows a decoy PDF while a script downloads a backdoor.
  3. A cron job keeps it running; later versions installed the MeshAgent remote tool.
T1566.001 Phishing attachmentT1053.003 CronT1219 Remote access tool

Source: The Hacker News, 25 Aug 2025, citing CYFIRMA, Hunt.io and Nextron.

RansomwareXELERA

The fake sarkari job notice

Why it's Indian: it copies the format of Indian public-sector recruitment notices, with vacancies, age limits and exam patterns, to hook job seekers.

  1. A Word file posing as a Food Corporation of India (FCI) job notification arrives by email.
  2. An embedded program steals browser passwords and cookies.
  3. The operator runs it through a Discord bot and can wreck the PC and demand Litecoin.
T1566.001 Phishing attachmentT1102 Web service C2

Source: Seqrite Labs, 12 Feb 2025.

Mobile malwareAndroid banking fraud

The traffic challan APK

Why it's Indian: it impersonates the Regional Transport Office and the VAHAN/Parivahan system, and it spreads on WhatsApp, India's default messaging app.

  1. A WhatsApp message with an RTO logo says your vehicle has a fine, with "VAHAN PARIVAHAN.apk" attached.
  2. Once installed, the app hides its icon and asks to become the default SMS app.
  3. It sends contacts to a Telegram bot and sends SMS from your phone, likely to register UPI apps in your name.

Source: Cyble, 9 Jul 2024. Earlier variants used credit card reward and KYC update themes.

Payment fraudUPI scams

The refund that takes money

Why it's Indian: it abuses UPI, India's instant payment system. You never need your UPI PIN to receive money, and scammers rely on people not knowing that.

  1. A scammer sends a "collect request" labelled as a refund or reversal.
  2. The victim enters their PIN to "receive" it, which approves a payment instead.
  3. Variants swap a shop's QR code for the scammer's, or use lookalike UPI handles.

Source: BusinessWorld.

ExtortionOrganised fraud networks

"Digital arrest"

Why it's Indian: scammers pose as police, CBI or other Indian agencies on video calls and claim the victim is under "arrest" online until they pay.

  1. A call or video call links the victim to a fake crime, often using spoofed numbers and forged documents.
  2. The victim is kept on camera for hours and told not to contact anyone.
  3. They are pressured to pay a "fine" or "security deposit" to avoid arrest.

Complaints to I4C fell from 1,23,672 in 2024 to 58,249 in 2025, with 16,377 by June 2026. In August 2026 the Supreme Court ordered RBI to set rules for freezing mule accounts within four weeks.

Source: Drishti IAS summary of the Supreme Court order, 10 Aug 2026, citing I4C figures.

Seen one of these? Report it

You lost money

Call the national cyber fraud helpline quickly, or file a complaint online.

1930cybercrime.gov.in
A suspicious call, SMS or WhatsApp, no money lost

Report it on Chakshu, part of the government's Sanchar Saathi service.

Report on Chakshu
Your organisation was attacked

Report to CERT-In within 6 hours of noticing it.

[email protected]1800-11-4949

Sources: PIB, 6 Aug 2024 (1930 and cybercrime.gov.in); PIB, 5 Feb 2026 (Chakshu); CERT-In Directions.

ATT&CK technique IDs are shown where the attack involves malware on a computer. Fraud schemes that work by manipulating people are not mapped.

Scam or real?

Eight messages of the kind people in India receive by SMS, WhatsApp and UPI apps. Decide which are scams. The bank in these examples, Nimbus Bank, is made up.

0 / 0 answered

Victims by state

Where the Indian organisations posted on ransomware leak sites in the past 12 months are based, by head office. Darker states had more victims. Tap a state on the map or in the ranking to see its sectors and groups.

Tap a state

States ranked

All states, by sector

By ransomware group

Shows counts only and never names a victim. States with fewer than three victims are not broken down by sector or group, so no single organisation can be picked out. Leak-site claims can be wrong or exaggerated.

Method: victims from ransomware.live (country IN, 19 Oct 2025 to 16 Oct 2026), with repeat posts about the same organisation counted once. Each head-office state was found from the organisation’s own website or, for well-known organisations, desk research. Organisations whose state could not be confirmed are left off the map rather than guessed.

Boundaries: DataMeet India state boundaries (ODbL), drawn to India's official outline. The file predates 2019, so Jammu & Kashmir and Ladakh share one shape, and Dadra & Nagar Haveli and Daman & Diu are combined.

Ransomware in India

Victims per month, November 2024 to October 2026. Red marks the last 12 months; the striped bar is October 2026 so far.

Most active groups in India, last 12 months

Sectors hit, last 12 months

Who is behind them

Ransomware groups hide who they are, so most origins come from researchers reading their chats, recruitment posts and infrastructure. Only law enforcement can confirm an identity. Each row shows how strong the evidence is.

GroupIndian victims, 12 monthsBelieved originEvidenceBasis

Espionage is a separate story. Transparent Tribe (APT36), behind the fake Kavach app and BOSS Linux attacks on the Made for India page, is assessed by researchers to be of Pakistani origin (The Hacker News, Aug 2025).

Source: ransomware.live public API, victims with country "IN", pulled on 19 Oct 2026 (latest post 16 Oct 2026). These are counts of leak-site posts, so they miss victims who paid quietly and include some false or recycled claims. Different trackers count differently: this feed shows 87 Indian victims in January to June 2026, where Cyble reported 77.

Who hit Asia-Pacific

Victims per quarter across Asia-Pacific. The striped bar is the current quarter so far.

Most-hit countries, last 12 months

Most active groups, last 12 months

What other trackers say

Each tracker watches leak sites differently, so totals differ. The second figure in each cell is the same period counted from ransomware.live, for comparison.

SourcePeriodAsia-Pacific victimsIndiaTop groups
CybleAPAC Threat Landscape Q1Jan–Mar 2026238
vs 278		45, ranked 1st
vs 46, 1st		The Gentlemen (about 24%), Qilin, INC Ransom
CybleGlobal Threat Landscape H1Jan–Jun 2026496
vs 641		77, 2nd after Thailand (82)
vs 87, 1st; Thailand 72		The Gentlemen 114, Qilin 64, LockBit 38
vs The Gentlemen 115, Qilin 86
Group-IBAPAC Threat LandscapeAug 2026190
vs 172		Not given for ransomwareThe Gentlemen 37, then Krybit and Qilin
vs The Gentlemen 20
ReliaQuestWorldwide, not APAC onlyMar–May 2026——The Gentlemen 300, Qilin 289
vs The Gentlemen 226, Qilin 361
Where they agree

India is the first or second most-hit country in Asia-Pacific in every count, and The Gentlemen and Qilin are the two busiest groups in every source.

Where they differ

Totals for the same months vary by up to a third, and the order of the top two groups flips between trackers. Treat any single ranking as one tracker's view.

Sources: ransomware.live public data, pulled 19 Oct 2026; Asia-Pacific here means 29 countries and territories from Pakistan east to New Zealand. Cyble Q1 2026; Cyble H1 2026; Group-IB, August 2026; ReliaQuest via Infosecurity Magazine.