Visual explainers on threats, attackers and the rules Indian organisations must follow when they get hit. Every number links back to its source.
This week
Last 12 weeks
Counts of Indian organisations newly posted on ransomware leak sites, from ransomware.live. Names are never shown. Updated every Monday.
The four clocks
In India, one cyber incident can start several legal reporting deadlines at once. Each clock starts when the organisation notices the incident. Pick an organisation type, then drag time forward.
Who was hit
T+6h
Hard deadline "Without delay", no fixed hourShaded bar: RBI's 2 to 6 hour windowTime axis is stretched in the first 24 hours.
Verified against official texts: CERT-In Directions No. 20(3)/2022, para (ii); RBI Cyber Security Framework in Banks (2 Jun 2016), Annex-3; RBI Master Directions for non-bank Payment System Operators (30 Jul 2024), para 22.4; SEBI CSCRF (20 Aug 2024), Annexure-O B.1; DPDP Rules 2025, G.S.R. 846(E), Rule 7 (in force from 13 May 2027). This is an explainer, not legal advice.
Who do you tell?
Three incidents at three Indian organisations. For each statement, decide whether it is a legal requirement. The answer and its source appear as soon as you choose.
0 / 0 answered
Made for India
Most attacks on Indian organisations use the same tools seen worldwide. These six stand out because they are built around India's own systems: government apps, recruitment, traffic fines, UPI and the police. Filter by who gets targeted.
EspionageTransparent Tribe (APT36)
The fake Kavach app
Why it's Indian: Kavach is the government's own two-factor login app, built by the National Informatics Centre. Officials must install it, so a fake installer looks routine.
Attackers clone Indian government websites, such as a defence officers' institute.
The download gives a working Kavach installer bundled with malware.
CrimsonRAT then gives remote control, with a keylogger.
T1036 MasqueradingT1204.002 Malicious file
Source: Cisco Talos, reported by BleepingComputer, 29 Mar 2022. The group has targeted Kavach since early 2022.
EspionageTransparent Tribe (APT36)
Malware for BOSS Linux
Why it's Indian: it targets BOSS (Bharat Operating System Solutions), an Indian-made Linux system used in parts of the government, alongside Windows.
A phishing email carries a "meeting letter" that looks like a PDF but is a Linux .desktop shortcut.
Opening it shows a decoy PDF while a script downloads a backdoor.
A cron job keeps it running; later versions installed the MeshAgent remote tool.
Why it's Indian: it impersonates the Regional Transport Office and the VAHAN/Parivahan system, and it spreads on WhatsApp, India's default messaging app.
A WhatsApp message with an RTO logo says your vehicle has a fine, with "VAHAN PARIVAHAN.apk" attached.
Once installed, the app hides its icon and asks to become the default SMS app.
It sends contacts to a Telegram bot and sends SMS from your phone, likely to register UPI apps in your name.
Source: Cyble, 9 Jul 2024. Earlier variants used credit card reward and KYC update themes.
Payment fraudUPI scams
The refund that takes money
Why it's Indian: it abuses UPI, India's instant payment system. You never need your UPI PIN to receive money, and scammers rely on people not knowing that.
A scammer sends a "collect request" labelled as a refund or reversal.
The victim enters their PIN to "receive" it, which approves a payment instead.
Variants swap a shop's QR code for the scammer's, or use lookalike UPI handles.
Why it's Indian: scammers pose as police, CBI or other Indian agencies on video calls and claim the victim is under "arrest" online until they pay.
A call or video call links the victim to a fake crime, often using spoofed numbers and forged documents.
The victim is kept on camera for hours and told not to contact anyone.
They are pressured to pay a "fine" or "security deposit" to avoid arrest.
Complaints to I4C fell from 1,23,672 in 2024 to 58,249 in 2025, with 16,377 by June 2026. In August 2026 the Supreme Court ordered RBI to set rules for freezing mule accounts within four weeks.
ATT&CK technique IDs are shown where the attack involves malware on a computer. Fraud schemes that work by manipulating people are not mapped.
Scam or real?
Eight messages of the kind people in India receive by SMS, WhatsApp and UPI apps. Decide which are scams. The bank in these examples, Nimbus Bank, is made up.
Where the Indian organisations posted on ransomware leak sites in the past 12 months are based, by head office. Darker states had more victims. Tap a state on the map or in the ranking to see its sectors and groups.
Tap a state
States ranked
All states, by sector
By ransomware group
Shows counts only and never names a victim. States with fewer than three victims are not broken down by sector or group, so no single organisation can be picked out. Leak-site claims can be wrong or exaggerated.
Method: victims from ransomware.live (country IN, 19 Oct 2025 to 16 Oct 2026), with repeat posts about the same organisation counted once. Each head-office state was found from the organisation’s own website or, for well-known organisations, desk research. Organisations whose state could not be confirmed are left off the map rather than guessed.
Boundaries: DataMeet India state boundaries (ODbL), drawn to India's official outline. The file predates 2019, so Jammu & Kashmir and Ladakh share one shape, and Dadra & Nagar Haveli and Daman & Diu are combined.
Cybercrime by state
Cybercrime cases registered by police in each state in 2024, from the National Crime Records Bureau’s Crime in India, the latest edition. These are cases, not complaints: far more people report online fraud than ever reach a police case.
Tap a state
States ranked
Cases across India, 2020 to 2024
What the 2024 cases were
Crime heads as recorded by NCRB. Sections 66 to 66E of the IT Act cover hacking, identity theft and cheating by impersonation. NCRB counts each case once, under its most serious offence.
Police cases are a small slice of the problem. From 2021 to 2025, people filed more than 65.9 lakh financial fraud complaints on the national cybercrime portal, reporting more than ₹55,050 crore lost. By 30 June 2026, more than ₹11,158 crore had been saved across 32.80 lakh complaints by stopping money before it left the system.
Differences between states partly reflect how readily police register cyber cases, not only how much crime there is. A high number can mean a state is better at turning complaints into cases.
Source: NCRB, Crime in India 2024, as given in the Ministry of Home Affairs written reply in Lok Sabha on 21 July 2026 (PIB), which also gives the portal figures. Rates per lakh people use the government’s official population projections (Technical Group on Population Projections, Ministry of Health and Family Welfare); 2024 populations are estimated from the 2025 and 2026 projections, so state rates can differ slightly from NCRB’s own. Jammu & Kashmir and Ladakh are combined to match the map.
Ransomware in India
Victims per month, November 2024 to October 2026. Red marks the last 12 months; the striped bar is October 2026 so far.
Most active groups in India, last 12 months
Sectors hit, last 12 months
Who is behind them
Ransomware groups hide who they are, so most origins come from researchers reading their chats, recruitment posts and infrastructure. Only law enforcement can confirm an identity. Each row shows how strong the evidence is.
Group
Indian victims, 12 months
Believed origin
Evidence
Basis
Espionage is a separate story. Transparent Tribe (APT36), behind the fake Kavach app and BOSS Linux attacks on the Made for India page, is assessed by researchers to be of Pakistani origin (The Hacker News, Aug 2025).
Source: ransomware.live public API, victims with country "IN", pulled on 19 Oct 2026 (latest post 16 Oct 2026). These are counts of leak-site posts, so they miss victims who paid quietly and include some false or recycled claims. Different trackers count differently: this feed shows 87 Indian victims in January to June 2026, where Cyble reported 77.
Who hit Asia-Pacific
Victims per quarter across Asia-Pacific. The striped bar is the current quarter so far.
Most-hit countries, last 12 months
Most active groups, last 12 months
What other trackers say
Each tracker watches leak sites differently, so totals differ. The second figure in each cell is the same period counted from ransomware.live, for comparison.
Source
Period
Asia-Pacific victims
India
Top groups
CybleAPAC Threat Landscape Q1
Jan–Mar 2026
238 vs 278
45, ranked 1st vs 46, 1st
The Gentlemen (about 24%), Qilin, INC Ransom
CybleGlobal Threat Landscape H1
Jan–Jun 2026
496 vs 641
77, 2nd after Thailand (82) vs 87, 1st; Thailand 72
The Gentlemen 114, Qilin 64, LockBit 38 vs The Gentlemen 115, Qilin 86
Group-IBAPAC Threat Landscape
Aug 2026
190 vs 172
Not given for ransomware
The Gentlemen 37, then Krybit and Qilin vs The Gentlemen 20
ReliaQuestWorldwide, not APAC only
Mar–May 2026
—
—
The Gentlemen 300, Qilin 289 vs The Gentlemen 226, Qilin 361
Where they agree
India is the first or second most-hit country in Asia-Pacific in every count, and The Gentlemen and Qilin are the two busiest groups in every source.
Where they differ
Totals for the same months vary by up to a third, and the order of the top two groups flips between trackers. Treat any single ranking as one tracker's view.
How the numbers on this site are made, what it will never publish, and how to tell us when something is wrong.
Where the numbers come from
Ransomware counts come from the public data of ransomware.live, which watches the leak sites where ransomware groups post the organisations they say they have hit. A victim is counted in the week and month it was posted, under the country recorded by ransomware.live. The data is refreshed every Monday.
Reporting rules and deadlines are read from the official texts of CERT-In, RBI, SEBI and the DPDP Rules, linked at the bottom of every page. They are explainers, not legal advice.
Attack methods and group origins each cite the published research or news report they come from, next to the claim.
What leak-site numbers can and cannot tell you
A leak-site post is a claim made by criminals, not a confirmed breach. Groups sometimes exaggerate, repost old data or name the wrong organisation. Victims who pay quietly are never posted, so the real number of attacks is higher.
Trackers also count differently. The Asia-Pacific page compares these figures with Cyble, Group-IB and ReliaQuest so you can see how far apart they are.
How victims are placed on the map
For each Indian victim, the state of its head office is looked up on the organisation’s own website, usually its contact page, or for well-known organisations through desk research. A state is recorded only when the evidence is clear. If it is not, the victim is left off the map rather than guessed. Organisations that turn out to be based outside India are removed. Repeat posts about the same organisation are counted once.
What this site never publishes
No victim names, websites or other identifiers appear anywhere on the site. Leak sites exist to pressure victims, and republishing names helps the extortion. States with fewer than three victims are not broken down by sector or group, so no single organisation can be picked out. The working list used to place victims on the map is kept private.
Indian organisations posted on leak sites in the 7 days up to the Monday update. The weekly average is the past 365 days divided by 52. The 12-week chart uses the same 7-day windows.
Reporting deadlines taken from CERT-In Directions (para ii), the RBI framework for banks (Annex-3), RBI Master Directions for non-bank payment operators (para 22.4), SEBI CSCRF (Annexure-O) and DPDP Rule 7, which applies from 13 May 2027. The clock starts when the incident is noticed; the exact trigger in each text differs slightly, so the timeline is a simplification.
The three incidents are made up. Each answer is checked against the same official texts as the four clocks, and the source is shown with the answer. It is a learning aid, not legal advice.
Each attack method is drawn from a named public report, cited on its card. MITRE ATT&CK technique IDs are shown only where malware runs on a computer. The reporting contacts (1930, cybercrime.gov.in, Chakshu, CERT-In) come from government press releases and CERT-In’s own pages.
The eight messages are written for this site, modelled on common scam patterns in India. The bank, Nimbus Bank, is invented, and phone numbers and account details are placeholders or masked. Your answers stay in your browser and are not sent anywhere.
Monthly leak-site posts for victims with country India in ransomware.live. Groups and sectors cover the past 365 days, with sectors as tagged by ransomware.live and untagged ones grouped as “Other or unknown”. Origins follow the evidence levels in the next section.
Past 365 days of Indian victims, placed by head-office state as described above. State boundaries come from DataMeet (ODbL) and predate 2019, so Jammu & Kashmir and Ladakh share one shape.
Police cases registered under cyber crime heads in 2024, from NCRB’s Crime in India as given in a Ministry of Home Affairs reply to Parliament. Rates per lakh people use the official population projections, with 2024 estimated from the 2025 and 2026 figures. These are cases, not complaints, and they partly reflect how readily each state’s police register them.
Victims across 29 countries and territories from Pakistan east to New Zealand, from ransomware.live. The tracker comparison uses figures from published Cyble, Group-IB and ReliaQuest reports for the periods named in the table.
How origins are judged
Ransomware groups hide who they are. The origins table on the Ransomware in India page gives each group one of four evidence levels:
Confirmed by police
Members named, charged or sanctioned by law enforcement or governments.
Strong
A government agency or several established research teams reach the same conclusion.
Moderate
One or two research teams point the same way, from language, working hours, infrastructure or forum activity.
Weak or none
Little reliable evidence, or claims that conflict.
“Origin” means where the operators are believed to be, or the criminal world they belong to. It does not mean a government is behind them unless that is stated.
Corrections
If you spot an error, write to [email protected]. Errors are fixed as soon as they are confirmed and listed here with the date, so changes are never made silently.
None so far. The site went public on 19 October 2026.
Who is behind this site
Threat Atlas India is an independent project. It is not affiliated with any government body, threat-intelligence tracker or security vendor. The site sets no cookies and shows no ads.