India

This page collects what official and public sources say about cyber threats to India. It uses statements and reports from the Press Information Bureau (PIB), Parliament replies as reported by Indian news outlets, advisories from CISA, the MITRE ATT&CK knowledge base, and Brandefense’s own research. India has a large national response system, but official sources give incident totals, not counts by sector or by group.

Threat groups that official sources link to India

APT38: the US advisory AA20-239A (CISA) says the BeagleBoyz, part of North Korea’s Reconnaissance General Bureau, likely targeted financial institutions in a list of nations from 2015 through 2020, and the list includes India. The advisory says the team overlaps to varying degrees with groups including APT38.

Lazarus Group: the advisory AA21-048A lists India among the countries targeted with AppleJeus malware since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. FBI, CISA and the US Treasury attribute Lazarus Group to North Korean state-sponsored actors. MITRE ATT&CK says the Dtrack spyware was used against Indian financial institutions, research facilities and the Kudankulam Nuclear Power Plant, and shares similarities with a campaign attributed to Lazarus. The Indian government has not attributed the Kudankulam infection.

MITRE ATT&CK also describes Transparent Tribe (APT36) as a suspected Pakistan-based group targeting diplomatic, defense and research organizations in India and Afghanistan. It describes Sidewinder as a suspected Indian threat actor group and says Patchwork may be a pro-Indian or Indian entity, not definitively attributed. These are MITRE’s descriptions only, with no incident on this page tied to them.

Incidents on record

This page lists only major incidents with national impact. Smaller incidents are left out. No official attribution was found for any of the three below.

How attackers target India: Brandefense research

State-linked and espionage activity. Brandefense’s post on Transparent Tribe (APT36) says the group targets India and Afghanistan, with operations against Indian diplomats and military personnel in embassies in Saudi Arabia and Kazakhstan. See also APT36 in 2025, and the technical analysis of the Poseidon backdoor used against Indian government staff (report version). The post on Cicada lists India among the countries named, and the post on Silent Chollima (APT45) describes the 2018 DTrack campaign against Indian financial institutions and ATMs. The Lazarus and Ocean Lotus posts list India in their country lists.

Groups suspected to be India-linked. Brandefense also covers groups that target India’s neighbors, including Razor Tiger, Hazy Tiger and Moonlight Tiger, and a May 2023 groups review that includes Sidewinder.

Ransomware and crime. The AvosLocker analysis lists India in the target list. The post on GoodWill ransomware says researchers attribute it to an India-based actor, with Hindi text in its note. The 2022 Q1 news archive mentions BlackCat attacks including India, and the Smishing Triad post says the campaign impersonates India Post.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums, credential trading, phishing infrastructure and threat actor activity. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand. On 19 January 2026 Brandefense announced that eGuardian was appointed distributor for India, Sri Lanka and Bangladesh (press room).

Law and national strategy

CERT-In operates under the Ministry of Electronics and Information Technology (MeitY) and is mandated by the Information Technology Act, 2000. Section 70A set up the National Critical Information Infrastructure Protection Center (NCIIPC), and section 70B names CERT-In as the national agency for incident response. In April 2022 CERT-In issued directions under section 70B on reporting of cyber incidents and keeping logs of ICT systems (PIB, 28 April 2022). A National Cyber Security Policy has been published with the vision of building a secure and resilient cyberspace. The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, giving full effect to the DPDP Act, 2023.

How incident response is organized

CERT-In is the national agency for cyber incident response. The National Cyber Coordination Centre, run by CERT-In, scans cyberspace for threats and shares metadata with agencies. NCIIPC protects critical information infrastructure and follows up on compliance with the 2018 Protected Systems Rules. The Ministry of Home Affairs created the Indian Cybercrime Coordination Centre (I4C) for cybercrime. Sector teams include CSIRT-Fin for finance and CSIRT-Power for the power sector, both working with CERT-In. The government has a Cyber Crisis Management Plan for all government bodies, and CERT-In runs an automated threat intelligence exchange platform for sharing alerts with organizations across sectors (PIB, 17 December 2025).

Sectors and rating

In 2025 CERT-In handled over 29.44 lakh incidents and issued 1,530 alerts, 390 vulnerability notes and 65 advisories (PIB, 23 January 2026). Most of the security audits CERT-In reported for 2025 were in banking and financial institutions, power and energy, and transport. In 2024-25 CERT-In audited 7,547 banking, financial services and insurance entities, 1,579 in power and energy and 582 in transport (PIB, 26 July 2025). See the sector table on this page for sources.

Personal data

The DPDP Rules, 2025 say that when a breach takes place the data fiduciary must inform all affected individuals without delay. The Data Protection Board of India is a fully digital body of four members that oversees compliance and inquires into breaches (PIB).

Official sources give CERT-In incident totals: 13,91,457 in 2022, 15,92,917 in 2023, 20,41,360 in 2024 and over 29.44 lakh in 2025. They give no counts by sector or by group. Minister of State Jitin Prasada said 204,844 occurrences relating to government organizations were reported in 2023 (Deccan Herald, 6 December 2024). Figures on attacks against Indian organizations will come from Brandefense Atlas.