Ransomware in India: A Growing Threat and the AI Response

By Jim Walter, Senior Threat Researcher, SentinelOne

As India continues to expand its digital infrastructure and embrace technology, it has simultaneously become a prime target for ransomware attacks. With its status as the world’s fifth-largest economy, India faces a unique set of challenges in the realm of cybersecurity. The widespread adoption of technology, often without adequate security measures, has caught the attention of cybercriminals, leading to an alarming rise in ransomware incidents.

The Rising Tide of Ransomware Attacks

The scale of ransomware attacks in India is unprecedented. A recent study by CERT-In (Indian Computer Emergency Response Team) revealed a staggering 51% increase in ransomware incidents in 2023 alone. This surge highlights the lucrative nature of these attacks, as cybercriminals exploit vulnerabilities in India’s IT systems.

Small and medium-sized businesses (SMBs) are particularly vulnerable. In July 2023, a ransomware attack incapacitated over 300 small Indian banks, disrupting access to essential financial services for millions of customers. In a country where digital banking is becoming increasingly vital, such disruptions can have severe consequences. According to Kaspersky, 53% of Indian SMBs experienced ransomware attacks in 2023, with a staggering 559 million attacks recorded between April and May of that year. This vulnerability stems from a combination of factors, including the sheer volume of SMBs and their often limited cybersecurity resources.

However, the threat extends beyond businesses. Ransomware has also been weaponized against individual citizens, locking personal devices and stealing sensitive information. In the first half of 2023 alone, ransomware incidents in India increased by 22%, underscoring the urgent need for enhanced cybersecurity measures.

Who’s Behind the Attacks?

The ransomware ecosystem in India is driven by a mix of global and local criminal groups. Despite ongoing efforts by authorities to combat cybercrime, organized groups such as Kryptina, FIN7, and Mallox have made India a key target.

Notable Ransomware Groups

• Mallox (aka TargetCompany): Known for targeting Microsoft SQL databases, Mallox has significantly impacted Indian enterprises that rely on Microsoft’s infrastructure for daily operations. Although their activities slowed somewhat between 2023 and 2024, they continue to target the region.

• RansomHub: Emerging in early 2024, RansomHub operates as a ransomware-as-a-service (RaaS) platform, collaborating with affiliates to deploy various ransomware families. Their operations include targeting multiple platforms and environments, making them a formidable threat.

• LockBit (3.0): Despite law enforcement actions against higher-level actors, LockBit operations have persisted, with their ransomware attacks remaining among the most prolific in the region.

• Kill Security: This group, which emerged in early 2024, has targeted multiple law enforcement agencies in India, further complicating the cybersecurity landscape.

• Cloak (ARCrypter): With a notable uptick in attacks from 2023 onward, ARCrypter operators have targeted various entities in India, leaking sensitive data to data leak sites.

In 2023, the average ransom demand reached a staggering $4.8 million (approximately ₹40 crore) per incident, with recovery costs often exceeding $1.35 million (above ₹11 crore). These figures do not account for hidden costs such as downtime, data loss, or reputational damage, which can be devastating for businesses.

The Financial Toll of Ransomware

For SMBs, the financial burden of ransomware can be overwhelming. The costs associated with paying ransoms, retrieving proprietary data, and recovering lost revenue can lead many businesses to opt for paying the ransom, despite the lack of guarantees regarding data restoration.

The Indian financial sector has been a particular target, with the National Payment Corporation of India (NPCI) forced to take systems offline temporarily due to an attack this year. Such incidents not only have financial implications but also erode public trust in India’s digital economy, hindering progress toward broader digital banking adoption.

Leveraging AI to Combat Ransomware

The sheer volume and sophistication of ransomware attacks have rendered traditional cybersecurity practices insufficient. In response, Indian companies are increasingly turning to artificial intelligence (AI) to bolster their cybersecurity defenses. AI-driven tools are essential for detecting and mitigating ransomware threats in real time.

For instance, Lenovo’s recent announcement of AI-enabled cybersecurity within their AI PCs exemplifies how this technology is becoming more accessible. Additionally, sectors like finance and healthcare are integrating AI into their security infrastructure. A recent survey indicated that 71% of Indian retailers have adopted or plan to adopt AI-driven cybersecurity solutions within the next year, while 59% of enterprises have already deployed such measures.

AI’s ability to analyze vast amounts of data and detect irregular patterns is crucial for a country of India’s size, enabling it to scale its cybersecurity efforts alongside its digital growth. From small startups to large enterprises, AI is no longer a luxury but a necessity for staying ahead of ransomware groups.

The Path Forward: A Collaborative Approach

India stands at a crossroads in its battle against ransomware. As criminal organizations become more sophisticated, securing businesses and individuals is increasingly urgent. While the integration of AI into cybersecurity offers hope, a concerted effort from both the government and the private sector is essential.

Initiatives like India’s Cyber Commando program aim to recruit top cybersecurity talent for a centralized approach that leverages data from both public and private sectors. However, with billions of rupees at stake, it is crucial for individuals and organizations not to wait for the country’s five-year cyber-defense plan to materialize.

Educating businesses and individuals on identifying and avoiding ransomware threats is paramount. By utilizing AI capabilities to understand threats in real time, stakeholders can make informed decisions and create more secure digital environments.

Conclusion

India’s rapid digital transformation has made it a hotspot for ransomware attacks. The growing sophistication of cybercriminals necessitates urgent action to secure the nation’s digital landscape. By embracing AI and fostering collaboration between the government and private sector, India can enhance its cybersecurity posture and mitigate the impact of ransomware, paving the way for a more secure digital future.