The Rising Threat of Ransomware in India: A Call for Urgent Action

By Jim Walter, Senior Threat Researcher at SentinelOne

As India continues to expand its digital infrastructure and embrace technology at an unprecedented pace, it has inadvertently become a prime target for ransomware attacks. With its position as the world’s fifth-largest economy, India faces a unique set of challenges in cybersecurity, particularly as cybercriminals exploit the vulnerabilities that arise from the widespread adoption of technologies lacking robust security measures.

The Escalating Ransomware Crisis

The consequences of this digital vulnerability are dire. Organised ransomware groups have shifted their focus to encompass small businesses, government institutions, and even individual citizens. The financial toll of cybercrime in India is staggering, costing billions annually in recovery efforts and lost business opportunities. Each attack not only drains resources but also erodes public trust in digital systems, hindering the nation’s progress toward a more secure digital future.

A Growing Impact

The scale of ransomware attacks in India is alarming. According to a recent study by CERT-In (Indian Computer Emergency Response Team), ransomware incidents surged by 51% in 2023 alone. This sharp increase underscores the lucrative nature of these attacks, as cybercriminals exploit the vulnerabilities inherent in India’s IT systems.

Small and medium-sized businesses (SMBs) are particularly vulnerable. In July 2023, a ransomware attack forced over 300 small Indian banks offline, disrupting essential financial services for millions of customers. In a country where digital banking is becoming increasingly vital, such disruptions have severe repercussions. A report by Kaspersky revealed that 53% of Indian SMBs experienced ransomware attacks in 2023, with a staggering 559 million attacks recorded between April and May alone. This vulnerability can be attributed to the larger volume of SMBs and their often inadequate cybersecurity measures.

However, the threat extends beyond businesses. Ransomware has also targeted individual citizens, locking personal devices and stealing sensitive information. In the first half of 2023, ransomware incidents in India increased by 22%, highlighting the urgent need for enhanced cybersecurity measures as more devices come online.

Who’s Behind India’s Ransomware Attacks?

The ransomware ecosystem in India is driven by a combination of global and local criminal groups. Despite ongoing efforts by authorities, organised cybercriminal entities such as Kryptina, FIN7, and Mallox have made India a key target.

• Mallox: Known for targeting Microsoft SQL databases, Mallox has significantly impacted Indian enterprises, many of which rely on Microsoft’s infrastructure for daily operations. Although their operations slowed somewhat between 2023 and 2024, the targeting of Indian businesses persists.

• RansomHub: Emerging in early 2024, RansomHub operates as a ransomware-as-a-service (RaaS), partnering with affiliates to deploy various ransomware families, including former ALPHV and LockBit. Their operations include building payloads for multiple platforms, making them a versatile threat.

• LockBit (3.0): Despite law enforcement actions against higher-level actors, LockBit operations have continued unabated. LockBit-centric ransomware attacks are among the most prolific in the region, posing a significant threat to Indian businesses.

• Kill Security: This group, which emerged in early 2024, has targeted multiple law enforcement agencies in India, leaking sensitive data and further complicating the cybersecurity landscape.

• Cloak (ARCrypter): Known for a notable uptick in attacks from 2023 onward, ARCrypter operators have targeted various entities in India, leaking data to the ‘Cloak’ data leak site.

In 2023, the average ransom demand reached $4.8 million (approximately ₹40 crore) per incident, with recovery costs often exceeding $1.35 million (above ₹11 crore). These figures do not account for hidden costs such as downtime, data loss, or damage to a company’s reputation, which can be devastating for businesses.

The Rising Toll of Ransomware in India

For SMBs, the financial burden of paying ransoms, retrieving proprietary data, and recovering lost revenue can be overwhelming. Consequently, many businesses opt to pay the ransom, despite the lack of guarantees that their data will be fully restored.

The financial sector has been particularly hard hit. In 2023, the National Payment Corporation of India (NPCI), responsible for the country’s digital payment systems, was forced to take systems offline temporarily due to an attack. Such incidents not only have financial implications but also erode public trust in India’s digital-first economy, hindering progress toward widespread digital banking adoption.

India’s AI Response to Ransomware

The sheer volume and sophistication of ransomware attacks have rendered traditional cybersecurity practices ineffective. In response, Indian companies are increasingly turning to artificial intelligence (AI) to bolster their cybersecurity defenses. AI-driven tools are essential for detecting and mitigating ransomware threats in real time.

For instance, Lenovo’s recent announcement of AI-enabled cybersecurity within their AI PCs exemplifies how this technology is becoming more accessible to the Indian public. Moreover, sectors such as finance and healthcare are increasingly integrating AI into their security infrastructure. A recent survey indicated that 71% of Indian retailers had adopted or planned to adopt AI-driven cybersecurity solutions within the next year, while 59% of enterprises had already deployed such technologies.

The ability of AI to quickly analyze vast amounts of data and detect irregular patterns is crucial for a country of India’s size, allowing for scalable cybersecurity efforts. From small startups to large enterprises, AI is no longer a luxury but a necessity to stay ahead of ransomware groups.

India at the Crossroads of Cybersecurity and Ransomware

India’s rapid digital transformation has made it a hotspot for ransomware attacks. As criminal organisations become more sophisticated, the urgency to secure Indian businesses and individuals intensifies. While the integration of AI into cybersecurity offers a glimmer of hope, effective security requires concerted action from both the government and the private sector.

One promising initiative is India’s Cyber Commando program, which aims to recruit top cybersecurity talent for a government-run centralized approach that leverages data from both private and public sectors. However, with billions of rupees at stake, it is imperative for individuals and organizations not to wait for the country’s five-year cyber-defense plan to materialize.

Educating businesses and individuals on identifying and avoiding ransomware threats is crucial. By utilizing AI capabilities to understand the threats they face in real time, stakeholders can make better decisions and create more secure digital environments.

Conclusion

The ransomware threat in India is a multifaceted challenge that requires immediate attention and action. As the nation continues to embrace digital transformation, the need for robust cybersecurity measures has never been more critical. By leveraging AI and fostering collaboration between the government and private sector, India can build a resilient digital infrastructure capable of withstanding the growing tide of cyber threats. The time to act is now—before the next ransomware attack strikes.