Visual explainers on threats, attackers and the rules Indian organisations must follow when they get hit. Every number links back to its source.
This week
Last 12 weeks
Counts of Indian organisations newly posted on ransomware leak sites, from ransomware.live. Names are never shown. Updated every Monday.
The four clocks
In India, one cyber incident can start several legal reporting deadlines at once. Each clock starts when the organisation notices the incident. Pick an organisation type, then drag time forward.
Who was hit
T+6h
Hard deadline "Without delay", no fixed hourShaded bar: RBI's 2 to 6 hour windowTime axis is stretched in the first 24 hours.
Verified against official texts: CERT-In Directions No. 20(3)/2022, para (ii); RBI Cyber Security Framework in Banks (2 Jun 2016), Annex-3; RBI Master Directions for non-bank Payment System Operators (30 Jul 2024), para 22.4; SEBI CSCRF (20 Aug 2024), Annexure-O B.1; DPDP Rules 2025, G.S.R. 846(E), Rule 7 (in force from 13 May 2027). This is an explainer, not legal advice.
How many incidents reach CERT-In
Cyber security incidents handled by CERT-In, per year
What CERT-In put out in 2025
Alerts and advisories warn organisations about active threats; vulnerability notes describe security flaws in software and how to fix them.
CERT-In counts everything reported to it or tracked by it, from phishing sites and website defacements to malware infections and network scanning. A rise can reflect more reporting and better detection as well as more attacks.
Three incidents at three Indian organisations. For each statement, decide whether it is a legal requirement. The answer and its source appear as soon as you choose.
0 / 0 answered
Made for India
Most attacks on Indian organisations use the same tools seen worldwide. These six stand out because they are built around India's own systems: government apps, recruitment, traffic fines, UPI and the police. Filter by who gets targeted.
EspionageTransparent Tribe (APT36)
The fake Kavach app
Why it's Indian: Kavach is the government's own two-factor login app, built by the National Informatics Centre. Officials must install it, so a fake installer looks routine.
Attackers clone Indian government websites, such as a defence officers' institute.
The download gives a working Kavach installer bundled with malware.
CrimsonRAT then gives remote control, with a keylogger.
T1036 MasqueradingT1204.002 Malicious file
Source: Cisco Talos, reported by BleepingComputer, 29 Mar 2022. The group has targeted Kavach since early 2022.
EspionageTransparent Tribe (APT36)
Malware for BOSS Linux
Why it's Indian: it targets BOSS (Bharat Operating System Solutions), an Indian-made Linux system used in parts of the government, alongside Windows.
A phishing email carries a "meeting letter" that looks like a PDF but is a Linux .desktop shortcut.
Opening it shows a decoy PDF while a script downloads a backdoor.
A cron job keeps it running; later versions installed the MeshAgent remote tool.
Why it's Indian: it impersonates the Regional Transport Office and the VAHAN/Parivahan system, and it spreads on WhatsApp, India's default messaging app.
A WhatsApp message with an RTO logo says your vehicle has a fine, with "VAHAN PARIVAHAN.apk" attached.
Once installed, the app hides its icon and asks to become the default SMS app.
It sends contacts to a Telegram bot and sends SMS from your phone, likely to register UPI apps in your name.
Source: Cyble, 9 Jul 2024. Earlier variants used credit card reward and KYC update themes.
Payment fraudUPI scams
The refund that takes money
Why it's Indian: it abuses UPI, India's instant payment system. You never need your UPI PIN to receive money, and scammers rely on people not knowing that.
A scammer sends a "collect request" labelled as a refund or reversal.
The victim enters their PIN to "receive" it, which approves a payment instead.
Variants swap a shop's QR code for the scammer's, or use lookalike UPI handles.
Why it's Indian: scammers pose as police, CBI or other Indian agencies on video calls and claim the victim is under "arrest" online until they pay.
A call or video call links the victim to a fake crime, often using spoofed numbers and forged documents.
The victim is kept on camera for hours and told not to contact anyone.
They are pressured to pay a "fine" or "security deposit" to avoid arrest.
Complaints to I4C fell from 1,23,672 in 2024 to 58,249 in 2025, with 16,377 by June 2026. In August 2026 the Supreme Court ordered RBI to set rules for freezing mule accounts within four weeks.
ATT&CK technique IDs are shown where the attack involves malware on a computer. Fraud schemes that work by manipulating people are not mapped.
Scam or real?
Eight messages of the kind people in India receive by SMS, WhatsApp and UPI apps. Decide which are scams. The bank in these examples, Nimbus Bank, is made up.
Cybercrime cases registered by police in each state in 2024, from the National Crime Records Bureau’s Crime in India, the latest edition. These are cases, not complaints: far more people report online fraud than ever reach a police case.
Tap a state
States ranked
Cases across India, 2020 to 2024
What the 2024 cases were
Crime heads as recorded by NCRB. Sections 66 to 66E of the IT Act cover hacking, identity theft and cheating by impersonation. NCRB counts each case once, under its most serious offence.
From complaint to police case
All cybercrime, 2024
Complaints made on the national cybercrime portal (cybercrime.gov.in and the 1930 helpline) against cybercrime cases registered by police, as counted by NCRB.
Financial fraud, 2021 to 2025
Complaints and FIRs from the portal’s fraud system. “Put on hold” is money marked as lien in bank accounts so fraudsters cannot move it. Separately, more than ₹11,158 crore had been saved across 32.80 lakh complaints by 30 June 2026.
This is not a straight pipeline: some cases are filed at police stations without a portal complaint, and some complaints are duplicates, small amounts or not crimes. The gap is still large. The government says turning complaints into FIRs is the job of state police. State-by-state complaint figures have not been published in an official, downloadable form, so this comparison is for India as a whole.
Differences between states partly reflect how readily police register cyber cases, not only how much crime there is. A high number can mean a state is better at turning complaints into cases.
Source: NCRB, Crime in India 2024, as given in the Ministry of Home Affairs written reply in Lok Sabha on 21 July 2026 (Lok Sabha unstarred question 251; also on PIB), which also gives the financial fraud figures for 2021 to 2025. Portal complaints for 2024 are from the Ministry’s Lok Sabha reply of 22 July 2025, reported by Business Standard. Rates per lakh people use the government’s official population projections (Technical Group on Population Projections, Ministry of Health and Family Welfare); 2024 populations are estimated from the 2025 and 2026 projections, so state rates can differ slightly from NCRB’s own. Jammu & Kashmir and Ladakh are combined to match the map.
Public security settings on the main website and email domain of 125 Indian banks, insurers and market institutions, checked from outside by BitScore on . Results are sector averages: no institution is named.
All 125 institutions
By sector
The move to .bank.in
These are signals anyone can check, not a full security rating: a bank can pass all of them and still be breached, or miss some and be well protected in other ways. Percentages are of institutions that could be tested for each check; where a site could not be read, it is left out of that check.
Source: BitScore India BFSI Readiness Index, edition, by BitScore Cybertech LLP, a security company, published under CC BY 4.0. We show a selection of its sector figures with plain-language labels; its full data is free to download. Institution lists come from RBI, IRDAI and SEBI.
Ransomware in India
When: victims month by month
Victims per month, November 2024 to October 2026. Red marks the last 12 months; the striped bar is October 2026 so far.
Who: the groups behind the attacks
Most active groups in India, last 12 months
Ransomware groups hide who they are, so most origins come from researchers reading their chats, recruitment posts and infrastructure. Only law enforcement can confirm an identity. Each row shows how strong the evidence is.
Group
Indian victims, 12 months
Believed origin
Evidence
Basis
Espionage is a separate story. Transparent Tribe (APT36), behind the fake Kavach app and BOSS Linux attacks on the Made for India page, is assessed by researchers to be of Pakistani origin (The Hacker News, Aug 2025).
What: the sectors hit
Sectors hit, last 12 months
Where: victims by state
Where the organisations posted in the past 12 months are based, by head office. Darker states had more victims. Tap a state on the map or in the ranking to see its sectors and groups.
Tap a state
States ranked
Sectors
Groups
Shows counts only and never names a victim. States with fewer than three victims are not broken down by sector or group, so no single organisation can be picked out. Leak-site claims can be wrong or exaggerated.
Source: ransomware.live public API, victims with country "IN", pulled on 19 Oct 2026 (latest post 16 Oct 2026). These are counts of leak-site posts, so they miss victims who paid quietly and include some false or recycled claims. Different trackers count differently: this feed shows 87 Indian victims in January to June 2026, where Cyble reported 77.
Method: victims from ransomware.live (country IN, 19 Oct 2025 to 16 Oct 2026), with repeat posts about the same organisation counted once. Each head-office state was found from the organisation’s own website or, for well-known organisations, desk research. Organisations whose state could not be confirmed are left off the map rather than guessed.
Boundaries: DataMeet India state boundaries (ODbL), drawn to India's official outline. The file predates 2019, so Jammu & Kashmir and Ladakh share one shape, and Dadra & Nagar Haveli and Daman & Diu are combined.
Who hit Asia-Pacific
Victims per quarter across Asia-Pacific. The striped bar is the current quarter so far.
Most-hit countries, last 12 months
Most active groups, last 12 months
What other trackers say
Each tracker watches leak sites differently, so totals differ. The second figure in each cell is the same period counted from ransomware.live, for comparison.
Source
Period
Asia-Pacific victims
India
Top groups
CybleAPAC Threat Landscape Q1
Jan–Mar 2026
238 vs 278
45, ranked 1st vs 46, 1st
The Gentlemen (about 24%), Qilin, INC Ransom
CybleGlobal Threat Landscape H1
Jan–Jun 2026
496 vs 641
77, 2nd after Thailand (82) vs 87, 1st; Thailand 72
The Gentlemen 114, Qilin 64, LockBit 38 vs The Gentlemen 115, Qilin 86
Group-IBAPAC Threat Landscape
Aug 2026
190 vs 172
Not given for ransomware
The Gentlemen 37, then Krybit and Qilin vs The Gentlemen 20
ReliaQuestWorldwide, not APAC only
Mar–May 2026
—
—
The Gentlemen 300, Qilin 289 vs The Gentlemen 226, Qilin 361
Where they agree
India is the first or second most-hit country in Asia-Pacific in every count, and The Gentlemen and Qilin are the two busiest groups in every source.
Where they differ
Totals for the same months vary by up to a third, and the order of the top two groups flips between trackers. Treat any single ranking as one tracker's view.
How the numbers on this site are made, what it will never publish, where to download the data, and how to tell us when something is wrong.
Where the numbers come from
Ransomware counts come from the public data of ransomware.live, which watches the leak sites where ransomware groups post the organisations they say they have hit. A victim is counted in the week and month it was posted, under the country recorded by ransomware.live. The data is refreshed every Monday.
Reporting rules and deadlines are read from the official texts of CERT-In, RBI, SEBI and the DPDP Rules, linked at the bottom of every page. They are explainers, not legal advice.
Official crime and incident figures (NCRB cybercrime cases, national portal complaints and CERT-In incident counts) come from Ministry replies to Parliament, linked on each page. They are published once or twice a year and updated here when new figures appear.
Bank and insurer security comes from BitScore, a private security company, and is labelled as vendor research. It is reused under its open licence, sector averages only.
Attack methods and group origins each cite the published research or news report they come from, next to the claim.
What leak-site numbers can and cannot tell you
A leak-site post is a claim made by criminals, not a confirmed breach. Groups sometimes exaggerate, repost old data or name the wrong organisation. Victims who pay quietly are never posted, so the real number of attacks is higher.
Trackers also count differently. The Asia-Pacific page compares these figures with Cyble, Group-IB and ReliaQuest so you can see how far apart they are.
How victims are placed on the map
For each Indian victim, the state of its head office is looked up on the organisation’s own website, usually its contact page, or for well-known organisations through desk research. A state is recorded only when the evidence is clear. If it is not, the victim is left off the map rather than guessed. Organisations that turn out to be based outside India are removed. Repeat posts about the same organisation are counted once.
What this site never publishes
No victim names, websites or other identifiers appear anywhere on the site. Leak sites exist to pressure victims, and republishing names helps the extortion. States with fewer than three victims are not broken down by sector or group, so no single organisation can be picked out. The working list used to place victims on the map is kept private. The bank and insurer page shows sector averages only and never scores a named institution.
Indian organisations posted on leak sites in the 7 days up to the Monday update. The weekly average is the past 365 days divided by 52. The 12-week chart uses the same 7-day windows.
Reporting deadlines taken from CERT-In Directions (para ii), the RBI framework for banks (Annex-3), RBI Master Directions for non-bank payment operators (para 22.4), SEBI CSCRF (Annexure-O) and DPDP Rule 7, which applies from 13 May 2027. The clock starts when the incident is noticed; the exact trigger in each text differs slightly, so the timeline is a simplification. The yearly CERT-In incident counts on the same page come from Ministry of Electronics and IT replies to Lok Sabha and include everything reported to or tracked by CERT-In, so they also reflect reporting and detection.
The three incidents are made up. Each answer is checked against the same official texts as the four clocks, and the source is shown with the answer. It is a learning aid, not legal advice.
Each attack method is drawn from a named public report, cited on its card. MITRE ATT&CK technique IDs are shown only where malware runs on a computer. The reporting contacts (1930, cybercrime.gov.in, Chakshu, CERT-In) come from government press releases and CERT-In’s own pages.
The eight messages are written for this site, modelled on common scam patterns in India. The bank, Nimbus Bank, is invented, and phone numbers and account details are placeholders or masked. Your answers stay in your browser and are not sent anywhere.
Monthly leak-site posts for victims with country India in ransomware.live. Groups and sectors cover the past 365 days, with sectors as tagged by ransomware.live and untagged ones grouped as “Other or unknown”. Origins follow the evidence levels in the next section. The state map in the same page uses unique organisations rather than posts, placed by head-office state as described above, so its totals are lower than the monthly chart’s. State boundaries come from DataMeet (ODbL) and predate 2019, so Jammu & Kashmir and Ladakh share one shape.
Police cases registered under cyber crime heads in 2024, from NCRB’s Crime in India as given in a Ministry of Home Affairs reply to Parliament. Rates per lakh people use the official population projections, with 2024 estimated from the 2025 and 2026 figures. These are cases, not complaints, and they partly reflect how readily each state’s police register them. The complaint-to-case comparison uses national portal figures from Ministry replies to Parliament; complaints and cases are counted by different systems, so the ratio is a rough guide.
Six checks anyone can run from outside, such as DMARC, DNSSEC and certificate settings, measured by BitScore on each institution’s main website and email domain. Percentages are of institutions that could be tested. It is not a full security rating, and no institution is named. The edition date is shown on the page.
Victims across 29 countries and territories from Pakistan east to New Zealand, from ransomware.live. The tracker comparison uses figures from published Cyble, Group-IB and ReliaQuest reports for the periods named in the table.
How origins are judged
Ransomware groups hide who they are. The origins table on the Ransomware in India page gives each group one of four evidence levels:
Confirmed by police
Members named, charged or sanctioned by law enforcement or governments.
Strong
A government agency or several established research teams reach the same conclusion.
Moderate
One or two research teams point the same way, from language, working hours, infrastructure or forum activity.
Weak or none
Little reliable evidence, or claims that conflict.
“Origin” means where the operators are believed to be, or the criminal world they belong to. It does not mean a government is behind them unless that is stated.
Download the data
The data behind these pages, as CSV files you can open in Excel or Google Sheets. Free to reuse under CC BY 4.0: credit Threat Atlas India and link back.
Ransomware victim counts are not offered as files, because ransomware.live’s terms do not allow its data to be republished that way; get it from ransomware.live directly. Bank and insurer figures are BitScore’s own data: download them from BitScore. No file names any victim. A readme lists the source of each file.
Corrections
If you spot an error, write to hello@threatatlasindia.com. Errors are fixed as soon as they are confirmed and listed here with the date, so changes are never made silently.
None so far. The site went public on 19 October 2026.
Site updates
20 October 2026. Merged Victims by state into Ransomware in India, which now runs When, Who, What and Where on one page. The old address forwards to the state map.
20 October 2026. Added the complaint-to-case comparison, bank and insurer security, CERT-In incidents per year, and data downloads.
19 October 2026. Site went public. Added Cybercrime by state and this page.
Who is behind this site
Threat Atlas India is an independent project. It is not affiliated with any government body, threat-intelligence tracker or security vendor. The site sets no cookies and shows no ads.