APT73 ransomware attacks in India
APT73 (also tracked as bashe) has posted 7 Indian organisations on its leak site since Oct 2024. Its latest Indian post was in Feb 2025. The sector it hits most often in India is financial services.
7Indian victims posted, all time
0in the past 12 months
Oct 2024first Indian post
Feb 2025latest Indian post
Indian victims by month
Red bars are the past 12 months.
Sectors hit in India, all time
Indian victims by year
Other gangs active in India
Leak-site counts from ransomware.live’s public data for victims with country India, as of 16 Oct 2026. A post is a claim made by a criminal group, not a confirmed breach, and the real number of attacks is higher. Victims are never named on this site. See the method.