INTELLIGENCE REPORT: CYBERSECURITY THREAT LANDSCAPE – INDIA (2025-2026)
EXECUTIVE SUMMARY
India currently faces a “High” to “Critical” level cyber threat environment. The volume of incidents has surged exponentially, with CERT-In reporting over 29.44 lakh (2.94 million) incidents in 2025 alone. The threat landscape has evolved from opportunistic cybercrime to sophisticated, state-sponsored espionage and AI-driven attacks targeting critical national infrastructure (CNI), government databases, and the financial sector. The integration of Generative AI by threat actors has significantly lowered the barrier for entry for complex phishing and social engineering campaigns.
Intelligence Report: Cybersecurity Threat Landscape – India (2025-2026)
1. Executive Summary
India currently faces a “High” to “Critical” level cyber threat environment. The volume of incidents has surged exponentially, with the Indian Computer Emergency Response Team (CERT-In) reporting over 29.44 lakh (2.94 million) incidents in 2025, with projections indicating a 30% increase for 2026. The financial impact is staggering, with cybercrime estimated to cost the Indian economy upwards of $10 billion annually.
2. Threat Actors & Attribution
A. State-Sponsored Advanced Persistent Threats (APTs)
Primary adversaries linked to neighboring states and global powers are actively targeting Indian strategic assets. The operational tempo of these groups has increased by 40% since 2024.
- Transparent Tribe (APT36): Linked to Pakistan; heavily targets Indian military, government, and research institutions using custom RATs (Remote Access Trojans) and malicious PDFs.
- RedEcho & SideWinder: Linked to China; focuses on critical infrastructure (power grids, ports) and defense networks using supply chain compromises and zero-day exploits.
- Objectives: Espionage, theft of intellectual property, pre-positioning in CNI for potential future disruption, and gathering intelligence on geopolitical policy.
B. Hacktivist Groups
There is a marked increase in hacktivist operations driven by geopolitical tensions. Groups like the Indian Cyber Force and counterpart state-aligned groups engage in defacing government portals, DDoSing services, and leaking citizen data to make political statements. This results in the disruption of e-governance services and erosion of public trust.
C. Organized Cybercrime Syndicates
Transnational syndicates, often operating from jurisdictions with weak cyber laws, focus on financial gain. They leverage Ransomware-as-a-Service (RaaS), banking trojans, and the dark web to monetize stolen data. There is a rising trend of syndicates partnering with state actors to share infrastructure.
3. Key Attack Vectors & Methodologies
| Attack Vector | Description & 2025/2026 Evolution | Prevalence |
|---|---|---|
| AI-Driven Phishing & Deepfakes | Use of LLMs for grammatically perfect spear-phishing. New: Real-time deepfake audio/video used for CEO fraud and bypassing biometric KYC. | Critical |
| Ransomware & Extortion | Triple-extortion tactics (encrypt data + threaten to leak + DDoS the network). Targets healthcare, manufacturing, and municipal corporations. | High |
| API Vulnerabilities | Exploiting broken object level authorization (BOLA) in fintech and e-governance APIs to scrape massive amounts of user data. | High |
| Supply Chain Compromise | Targeting third-party vendors, MSPs (Managed Service Providers), and open-source libraries to gain backdoor access to larger target networks. | Increasing |
| Cloud Misconfiguration | Exploiting poor IAM (Identity and Access Management) practices in AWS/Azure environments to steal data or deploy crypto-miners. | High |
| IoT & OT Botnets | Hijacking insecure Operational Technology (OT) and IoT devices to launch DDoS attacks or pivot into corporate IT networks. | Moderate |
4. Targeted Sectors & Impact Analysis
Government & E-Governance
Context: Multiple state and central portals targeted. Data compromised includes Aadhaar links, bank details, and personal identifiers.
Impact: Mass identity fraud, national security implications, and loss of citizen trust in digital public infrastructure (DPI).
Healthcare & Research
Context: Ransomware attacks on hospitals (e.g., AIIMS network) and scraping of health ministry databases.
Impact: Disruption of critical patient care, cancellation of surgeries, loss of Electronic Medical Records (EMR), and leakage of sensitive genetic/health data.
Financial Services & Fintech
Context: Targeted attacks on banks, NBFCs, and UPI payment gateways. Credential stuffing and SIM-swapping are rampant.
Impact: Direct financial loss, systemic liquidity risks, and regulatory penalties under the new DPDP Act.
Critical Infrastructure & Telecom
Context: Probing of power utilities, telecom 5G infrastructure, and ports.
Impact: Potential for large-scale blackouts, disruption of national communications, and industrial paralysis.
5. Major Data Breaches (Historical & Recent Context)
- Aadhaar & CoWIN Data Scraping (2018-2024): Continuous exposure of billions of records due to API vulnerabilities, highlighting systemic flaws in data handling.
- ICMR & Health Ministry Leaks (2023-2025): Exposure of hundreds of millions of health records, including unredacted personal details of citizens.
- Cosmos Bank & Recent Cooperative Bank Heists: Highlighted systemic vulnerabilities in banking cybersecurity, SWIFT network exploitation, and ATM switching malware.
- AIIMS Ransomware Attack (2022-2023 fallout): Demonstrated the catastrophic operational impact of ransomware on critical healthcare infrastructure.
6. Geographic Hotspots
- Maharashtra, Delhi, Karnataka (Bengaluru), Telangana (Hyderabad): Highest concentration of attacks due to high digital penetration, presence of financial/IT hubs, and high-value targets.
- Gujarat & Tamil Nadu: High targeting of manufacturing and port infrastructure (OT/ICS attacks).
- Tier-2 & Tier-3 Cities: Increasingly targeted by ransomware syndicates due to weaker cybersecurity postures, lack of dedicated SOC (Security Operations Center) teams, and outdated legacy systems in local government offices.
7. Government Response & Mitigation
- CERT-In: Acting as the central nodal agency, handling millions of incidents and issuing thousands of advisories. Mandating 6-hour incident reporting.
- DPDP Act 2023 Enforcement: The Digital Personal Data Protection Act is now being strictly enforced in 2025/2026, introducing massive financial penalties (up to ₹250 Crore) for data fiduciaries failing to prevent breaches.
- National Cyber Security Strategy: Ongoing implementation focusing on securing CNI, creating a skilled workforce of 500,000+ cybersecurity professionals, and promoting indigenous security products.
- Defence Cyber Agency (DCYA): Enhanced military cyber capabilities to counter state-sponsored APTs and protect defense networks.
- Cyber Swachhta Kendra: Continued initiatives to clean botnets, provide malware analysis, and secure the Indian cyberspace.
8. Strategic Recommendations for Stakeholders
For Individuals
- Enable Multi-Factor Authentication (MFA) (preferably hardware keys or authenticator apps, not SMS) on all accounts.
- Be highly skeptical of unsolicited communications; verify urgent requests via a secondary channel to combat AI deepfakes.
- Regularly update software, use reputable endpoint protection, and monitor financial statements for micro-transactions.
For Organizations (incl. Saro)
- Implement Zero Trust Architecture (ZTA) and strict Identity and Access Management (IAM).
- Conduct regular VAPT and specifically test API security.
- Train employees on recognizing AI-generated phishing and establish “verify before trust” protocols for financial transfers.
- Maintain immutable, offline backups and test Disaster Recovery (DR) plans quarterly.
- Ensure strict compliance with CERT-In and DPDP Act reporting guidelines.
- Procure comprehensive Cyber Insurance to mitigate financial fallout.
For Policy Makers
- Strengthen international cooperation and mutual legal assistance treaties (MLATs) for cross-border cybercrime investigation.
- Invest heavily in indigenous cybersecurity tools, secure hardware, and AI-driven defense systems.
- Mandate “Security by Design” principles for all Digital Public Infrastructure (DPI) and government tech stacks.
- Enhance cybersecurity awareness campaigns in regional languages to protect Tier-2/3 demographics.
9. Conclusion
The cyber threat to India is no longer just a technical IT issue; it is a critical national security and economic imperative. The convergence of Generative AI, aggressive state-sponsored APTs, and highly organized cybercrime syndicates creates a complex, multi-dimensional threat matrix.
As India accelerates its digital transformation and solidifies its position as a global digital public infrastructure leader, the attack surface will only expand. Proactive defense, continuous threat hunting, robust incident response capabilities, and strict regulatory compliance are not just optional best practices—they are essential prerequisites for national resilience in 2026 and beyond.