Ransomware in India: Evolving Threats and Defense

A Monday morning with ransomware

You walk in, coffee in hand, sit down, and the screen shows a red message you've never seen, and when you open the file explorer to check, every file has been renamed to something ending in .locked. Shared drive, gone. Accounting system, dead. Within ten minutes, every single computer in the building has the same message: pay 5 Bitcoin or your data gets published online.

It happened at AIIMS Delhi. Pune's factories got hit too. Banks, logistics firms and small IT shops across the country keep getting hit, over and over, and it frustrates me how little most Indian organizations are doing about it.

India recorded over 18 million ransomware attempts in just the first three quarters of 2025, which works out to roughly one attempt every 1.3 seconds. And those are only the ones that got caught.

I still talk to business owners who think their antivirus is enough. It isn't, not even close.

---

What ransomware looks like now

The picture most people carry around goes like this: somebody clicks a bad email, files get encrypted, you pay some Bitcoin and maybe get them back. That version is ancient history. The real thing has moved on a lot, and the gap between how bad it's gotten and how little most people's understanding has caught up is part of the problem.

Modern ransomware operations run like businesses, and I mean that literally, because they have dedicated teams for different stages of an attack, customer service for victims, even affiliate programs.

How they get in

Four doors, usually.

Phishing emails are still number one, though they're nothing like the old "Dear Sir, you have won a lottery" messages, because today's versions reference real projects, use the names of your colleagues and copy your company's email templates. Our guide on cybersecurity tips and best practices covers training your team to catch these, but even trained people get fooled sometimes, because the fakes have gotten that good.

Then there's unpatched software. VPN appliances, web servers, remote desktop left open to the internet. The Log4j bug from 2021 is still being used against Indian organizations that never bothered to update.

Stolen credentials are the third route. An employee reuses their corporate VPN password on some random forum, the forum gets breached, and attackers buy the leaked password dump in bulk.

The fourth is the supply chain, where malware arrives through a trusted software update or a vendor's compromised system. These are nasty because everything looks legitimate.

What happens once they're inside

They don't encrypt anything right away. That's the scary bit. For days, sometimes weeks, they poke around your network without making noise: mapping everything, finding your backup servers, working out which systems matter most, copying your sensitive data to their own servers and switching off your security tools one by one. The average dwell time before they pull the trigger is somewhere around 5-10 days, so for up to ten days someone is living inside your network and you have no idea.

Modern attackers are patient. Incident response reports regularly describe intruders spending weeks inside a network before triggering the encryption. In that time they map every server, identify executives' email accounts, download client contracts, and read internal chat to work out which clients would hurt the most to lose. By the time they launch, they know exactly how much to ask for, because they've read the company's financial statements.

Then came double extortion, which changed the game. Since they've already stolen your data, the demand becomes two demands: pay us to decrypt your files, AND pay us to not publish everything we took. Some groups have pushed it to triple extortion, where they contact your customers directly to tell them their personal information has been compromised. Imagine your hospital's patient records showing up on a public leak site. Or your clients getting emails about their stolen financial data.

What's most alarming is that you don't need to be a skilled programmer to launch these attacks anymore. Ransomware groups run what are basically franchises. It's called Ransomware as a Service, or RaaS. The operators build the malware, run the infrastructure and handle negotiations and payments, then recruit "affiliates" (freelance hackers) who do the break-ins and take 70-80% of the ransom. Gig economy hacking. Wonderful.

The brands come and go. LockBit was the biggest franchise until police seized its leak sites, source code and decryption keys in Operation Cronos in February 2024, and BlackCat (ALPHV) vanished a month later after keeping a $22 million ransom that it owed partly to its own affiliate. Neither ending stopped much. LockBit had a new leak site up within days and released a version 5.0 in September 2025, while Akira and Qilin became the two variants most often reported to the FBI in 2025, because the affiliates simply moved to whoever was still open for business.

The technical progression of a typical attack

Initial access happens through one of the methods above. The attacker then drops a small tool, often a legitimate system administration utility like PsExec or some PowerShell scripts, so antivirus doesn't fire. They run network discovery commands to map Active Directory, file shares and database servers, then create extra user accounts or modify existing ones, so they keep access even if the original entry point is found and closed. They find the backup solutions and disable them. They exfiltrate data to cloud storage or their own servers, usually compressed first and sent in small chunks so data loss prevention rules stay quiet. Only after all of that do they deploy the ransomware payload across every machine they can reach, usually at 2 or 3 AM on a Friday night or a holiday weekend when nobody's watching.

---

Indian organizations keep getting hit, and the mistakes repeat

AIIMS Delhi, November 2022. The attack took down patient registration, billing, lab reports and appointment scheduling for nearly two weeks, so doctors went back to pen and paper while treating thousands of patients a day, and the rebuilding afterwards dragged on for months. The reputational damage alone was massive. Worse than the disruption, though, was how much patient data was potentially exposed. Medical records are some of the most valuable data on the dark web because they bundle personal identifiers, financial info and health data in one place. New credit card? Easy. New medical history? Impossible.

AIIMS at least made the news.

Most ransomware victims in India are small and medium businesses nobody ever hears about: manufacturing companies in Pune and Chennai, logistics firms in Gujarat, small IT services providers in Bangalore, retail chains. Constantly.

Picture a typical small CA firm with about 30 employees. Its only backup is an external hard drive plugged into the server 24/7, so when ransomware hits, it encrypts the backup along with everything else. Faced with telling hundreds of clients their tax records are gone, firms in this position often pay the ransom quietly, and the incident is never reported.

A textile manufacturer in Surat got hit through their payroll software vendor, whose update mechanism had been compromised, so a routine update came packaged with ransomware. Their entire ERP system was down for nine days. They put the losses at Rs 40 lakh from missed orders and production shutdowns alone, on top of the ransom they paid.

Stories like these repeat across every sector and every city, and most never become public.

Why them? Easy money. A company with 50 employees typically has one IT person who looks after everything from email to the printer, and behind that one person there's no security team, no monitoring and no incident response plan. Plenty of them run pirated or unpatched software (Windows 7 machines on factory floors aren't unusual even now), while sitting on thousands of customer records, financial data and proprietary business information protected by a basic antivirus and crossed fingers. When they get hit, they can't afford weeks of downtime, because a manufacturing company locked out of its ERP system loses lakhs per day. So they pay, quietly, and never report it.

India's banking and financial sector gets targeted too, from cooperative banks and NBFCs to fintech startups, though most of those incidents stay private for regulatory and reputational reasons. RBI has issued multiple circulars on cybersecurity requirements, but compliance among smaller financial institutions is spotty at best.

Why India specifically?

This one bugs me most. We digitized incredibly fast (Aadhaar, UPI, DigiLocker, e-governance portals everywhere) and security didn't keep pace, so there's a gap between how much we've put online and how well we protect it. India needs roughly 1.5 million cybersecurity professionals. We have fewer than 500,000, and that talent sits mostly in big IT companies and MNCs, which leaves SMBs, government agencies and hospitals badly understaffed. Add fragmented infrastructure, a messy mix of cloud services, outdated on-premises servers and legacy systems that break if you upgrade them, and attackers get an environment they love. CERT-In exists and the IT Act exists. Enforcement is patchy. The six-hour incident reporting mandate from 2022 was a good step, but plenty of organizations still don't comply, and nobody's really sure what happens to the ones that don't.

There's a cultural factor too. In a lot of Indian organizations, cybersecurity is treated as an IT department problem rather than a business problem. The CEO doesn't think about it. The board never asks. Budget requests for security tools get cut because "we haven't been hacked so far, so why spend money on it." That mindset works perfectly until the day it doesn't, and by then the cost is orders of magnitude higher than proper prevention would have been.

---

What stops ransomware

There's no magic product you can buy that makes this go away. If someone's selling you "complete ransomware protection," they're lying. Defense works in layers. It takes steady effort, but the steps below cut your risk by a huge margin.

Backups, backups, backups

Follow the 3-2-1 rule: three copies of your data, on two different storage types (say a local NAS plus cloud), with one copy offsite and disconnected from any network. With solid backups you can tell the attacker to go pound sand and restore everything.

Test your restores. Regularly. An unverified backup is a guess. Schedule restore drills every quarter, where you really rebuild a server from backup and see if it works. Protect the backup system itself as well. Modern ransomware hunts for backup solutions like Veeam, Acronis and Windows Backup and goes after them first, so use separate credentials for backup administration. Keep at least one copy somewhere ransomware physically can't reach: a disconnected external drive, a write-once cloud bucket, or good old tape storage.

A practical setup that works for most SMBs: use an automated backup tool (Veeam Community Edition is free for up to 10 workloads) to back up to a local NAS daily. Replicate that NAS to a cloud provider, such as AWS S3, Azure Blob, or Backblaze B2 if you're on a budget, with versioning and immutability turned on. Once a week, run a manual backup to an external drive, physically disconnect it and label it with the date. Keep three rotating drives. Old-school? Sure. It works.

Lock down email

Most attacks still start here. Get advanced filtering that can detect phishing; Microsoft Defender for Office 365 or Google Workspace's built-in tools are decent starting points. Set up DMARC, DKIM and SPF for your domain to prevent spoofing, and while you're in the admin console, disable Office document macros by default, since most real business processes don't need them and a macro-laden attachment is one of the oldest ways in. Keep security awareness training going all year, instead of one PowerPoint session everyone sleeps through; services like KnowBe4 and Cofense run simulated phishing exercises for the Indian market. Run them monthly.

The simulations matter. Security awareness vendors such as KnowBe4 publish data showing click rates on simulated phishing emails dropping sharply after months of regular testing and training. The reason is consistency: one session a year does almost nothing, while a fake phishing email landing every month slowly builds a real reflex in people who used to click everything.

Get real endpoint protection

Antivirus alone won't do. You need Endpoint Detection and Response (EDR), which watches for suspicious behavior as well as known malware signatures.

Feature	Traditional Antivirus	EDR Solution
Detection Method	Signature matching	Behavioral analysis
Ransomware Detection	Known variants only	Detects encryption behavior
Response Capability	Quarantine file	Isolate endpoint, kill process
Visibility	Individual machine	Network-wide
Investigation	Minimal	Full forensic timeline
Cost	Low	Higher

For Indian SMBs, CrowdStrike Falcon Go, SentinelOne and Microsoft Defender for Business all offer EDR at reasonable prices, and even a basic EDR setup is worlds better than running nothing but an antivirus from 2019.

The thing EDR gives you that antivirus doesn't is visibility. Say a process suddenly starts reading every file on the disk in sequence, or PowerShell opens connections to unusual IP addresses. EDR flags it and can automatically isolate that machine from the network before the damage spreads. Antivirus just waits. You find out something's wrong when the ransom note appears.

Patch your stuff

Boring, I know. I know legacy software breaks when you update the OS, and I know that one factory machine runs some ancient app that only works on Windows 7. But unpatched systems are the attackers' easiest way in. Automate patching on workstations and schedule monthly patching windows for servers. VPN appliances, web servers and email gateways need patching within days of a critical vulnerability announcement, not weeks. As for that Windows 7 machine on the factory floor, put it on its own network segment with strict firewall rules, keep it off the internet, and don't let it talk to anything it doesn't absolutely need.

Segment your network

Don't run a flat network where every device can talk to every other device. For home users and small offices, our complete guide to home network security covers segmentation and the other basics. In a business, office workstations shouldn't be able to reach database servers directly, IoT devices like printers, cameras and sensors belong on their own VLAN, and servers go behind internal firewalls with tight rules. Backups get their own segment. Then if ransomware compromises one area, it can't easily jump to the others, which buys you time to spot it and contain the damage.

Segmentation works like fire doors in a building: one room catches fire and the doors keep the flames from taking the whole floor. A flat network is a building with no doors at all. Most small businesses I've looked at have everything on one flat subnet, from employee laptops and the accounting server to the NAS, the security cameras and the CEO's personal iPad. Ransomware on any one of those can reach the rest. Segmentation fixes that.

MFA on everything

VPN, email, cloud apps, admin panels, every last one. Multi-factor authentication makes stolen credentials close to useless, because even with someone's password an attacker can't get in without the second factor. Use push-notification MFA (like Microsoft Authenticator) rather than SMS codes. SIM swap attacks make SMS-based OTPs unreliable.

Restrict admin privileges aggressively

Remove local admin rights. Most employees don't need them on their computers. Give IT staff a separate admin account that they log into only for admin work, never for browsing the web or checking email. The principle of least privilege sounds like textbook stuff, but in practice most Indian businesses give everyone admin access because it's easier than handling help desk tickets. Attackers count on exactly that convenience.

---

When prevention fails (and sometimes it will)

You need an incident response plan. Write it down, practice it, and keep it somewhere you can reach even when every system is encrypted. On paper. In a binder. Seriously.

Detection comes first: how will you know you've been hit? Watch for odd encryption activity. Mass file renaming, ransom notes popping up on screens and EDR alerts are the usual signs. Next is containment. Isolate affected machines from the network immediately by disconnecting WiFi and ethernet, but don't shut them down, because forensic evidence in memory matters. Then communication: who gets called? Leadership, the IT team, legal, CERT-In (you've got six hours, and it's mandatory), possibly law enforcement, and affected customers. Last comes recovery, which means restoring from backups, rebuilding compromised systems from clean images, changing every password, and revoking and reissuing certificates.

Turn this into a simple checklist anyone can follow under pressure. Nobody thinks clearly mid-incident, because the adrenaline's pumping, the phones are ringing, the CEO wants answers right now and your IT person is still trying to work out how bad it is. A laminated card with "Step 1: Unplug affected machines from network. Step 2: Call [name] at [number]. Step 3: Do NOT shut down machines." is worth more than a 50-page policy document nobody can find.

Do you pay? The FBI says no. Paying funds criminals and there's no guarantee you get your data back. But when patient lives hang in the balance, or your business won't survive weeks of downtime, some organizations decide paying costs less than not paying. If you go that route, bring in legal counsel and a professional ransomware negotiation firm, and don't try to negotiate directly. These firms know the going rates, they know which groups hand over working decryption keys, and they know how to avoid making things worse. Negotiators have told me initial ransom demands are almost always inflated; groups expect to haggle and typically settle for 20-40% of the first ask.

CERT-In requirements you should know about

Incidents must be reported to CERT-In within six hours. ICT system logs have to be kept for 180 days within Indian jurisdiction, VPN providers must keep customer data for five years, and data centers and cloud providers must report incidents and maintain records. CERT-In's ransomware advisories recommend regular offline backups, keeping everything updated, strong unique passwords with MFA, disabling unnecessary remote access, restricting admin privileges, and monitoring network traffic. Following them keeps you clear of penalties, and it also builds the kind of resilience that gets you through an attack.

---

Cyber insurance is probably worth a look

Cyber insurance has become a real market in India. ICICI Lombard, HDFC Ergo, Bajaj Allianz and others offer policies covering ransom payments (in some cases), business interruption during recovery, data recovery costs, legal and regulatory expenses, notification costs for affected individuals, and forensic investigation fees. An SMB might pay Rs 50,000-2,00,000 per year for Rs 50 lakh-1 crore in coverage.

Insurers are getting pickier. Without MFA, endpoint protection and backup procedures you might get denied, or face sky-high premiums. Read every exclusion before you sign.

A few things to ask before you sign. Does it cover ransomware payments directly, or only recovery costs? What's the waiting period before business interruption coverage kicks in? Does it make you use specific incident response vendors? What's the reporting timeline? Some policies void coverage if you don't notify the insurer within 24-48 hours of discovering an incident. And is social engineering fraud covered? Often it isn't by default.

My take? Useful safety net. No replacement for securing your systems. Same logic as health insurance: having a policy doesn't mean you can skip exercising.

---

Start now, before you're hit

If all of this feels like too much, here's the order I'd go in.

This week, turn on MFA for all email, VPN and cloud services. Check that your backups are current and test restoring something. Update every operating system. Then give your team a five-minute briefing on phishing basics.

This month, evaluate and set up an EDR solution and get proper email filtering with anti-phishing features, then review who has administrative access and cut it down to the people who truly need it, which in a typical small office will be a much shorter list than the one you start with. Write a basic incident response document. Even a one-pager beats nothing.

This quarter, run a security assessment or pen test, implement network segmentation, and start a recurring security awareness training program. Look into cyber insurance. Set up log monitoring and alerting.

After that it's ongoing, forever: monthly patching, quarterly backup restore tests, yearly incident response drills, continuous training.

What does all this cost a 50-person company? Roughly Rs 5-10 lakh per year for EDR, email security, backup tools and periodic assessments. A ransomware incident at the same company runs anywhere from Rs 20 lakh to Rs 2 crore once you add up ransom, downtime, data loss, legal fees and reputation damage. The math is obvious; the hard part is getting people to act before they learn it the painful way.

---

So where does this leave us?

Ransomware isn't slowing down. The money's too good. AI is making phishing emails harder to spot, helping attackers find vulnerabilities faster and automating parts of the attack chain, while RaaS platforms keep lowering the barrier to entry. Every month the attacker side gets a little stronger.

The defender's playbook hasn't changed: update your systems, keep backups you've tested, train the humans in the loop, and have a plan for the worst case. Organizations that do these basics consistently are far less likely to become victims, and when they do get hit, they bounce back instead of going under.

One question remains uncomfortable. If the average Indian SMB can't afford a single dedicated security person, if hospitals run critical systems on decade-old software, and if we've got a 1-million-person cybersecurity talent gap, are we going to close that gap before attackers exploit it? Or will we keep reading about the next big breach and hoping it doesn't happen to us?

I don't have a clean answer. I do know that the organizations treating ransomware as a "when" problem instead of an "if" problem are the ones that survive it. The ones who assume it won't happen to them end up in a conference room at midnight, staring at a ransom note and wishing they'd done the boring work six months ago.

Start with MFA and backups. This week. Everything else can follow.