Key Takeaways
- 2026 active ransomware groups targeting India: LockBit (resurgent), BlackCat/ALPHV, Akira, Play, Royal, 8Base, Medusa, and several Indian-language-focused affiliates.
- Top entry vectors: exposed RDP/VPN, phished credentials with no MFA, unpatched edge devices (Fortinet, Citrix, ConnectWise), and supply chain compromise.
- Indian sectors most targeted: manufacturing, healthcare, BFSI, IT services, education, and increasingly logistics.
- Median dwell time is 8 days, the window between initial access and ransomware deployment. Detection within that window dramatically reduces blast radius.
- The defense baseline that stops 80% of attempts: MFA everywhere, EDR with active prevention, patched edge devices, immutable backups, segmented networks.
The 2026 Indian Ransomware Landscape
Ransomware against Indian targets has shifted in 2026. Three trends: groups specialize by sector (LockBit-affiliated actors heavily target Indian manufacturing; Akira and Medusa hit BFSI; Play and Royal target healthcare and education), initial access has shifted from email to credential abuse and edge device exploitation, and payment demands have grown 40% year-over-year for confirmed Indian victims.
The CERT-In quarterly threat report confirms ransomware as the top tier-1 incident category for Indian enterprises in 2026, displacing data theft. The financial impact is substantial, average direct cost INR 12-18 crore per major Indian incident, before customer churn and regulatory penalties under DPDP Act 2023.
LockBit and Its Affiliates
LockBit 3.0 was disrupted by international law enforcement in early 2024 but resurged through 2025-26 with new infrastructure and a fragmented affiliate model. In India, LockBit-affiliated actors are the most prolific source of mid-market enterprise ransomware. Their playbook is technical, mature and relentless.
- Initial access: stolen or brute-forced VPN credentials, exposed RDP, vulnerable edge devices
- Lateral movement: Cobalt Strike, AnyDesk legitimate-tool abuse, native Windows tooling (LOLBins)
- Persistence: scheduled tasks, abuse of legitimate remote access tools, AD privilege escalation
- Data exfiltration: Rclone to cloud storage, MEGA, custom HTTPS C2
- Encryption: LockBit ransomware deployed via PsExec or GPO, simultaneously across hundreds of hosts
- Defenses: MFA on ALL VPN/RDP, edge device patching, EDR in prevention mode, egress filtering of cloud storage, immutable backups
Free Ransomware Readiness Review
60-minute call with an OSCP/CISSP certified consultant. We will benchmark your defenses against the 2026 ransomware playbook and identify your top 3 weaknesses.
Book Free Review →BlackCat (ALPHV) and Akira
BlackCat (also known as ALPHV) was disrupted in late 2023 but rebranded affiliates continue. Akira emerged in 2023 as a Linux-and-Windows ransomware specializing in VMware ESXi attacks, devastating for virtualized data centers. Both groups now target Indian BFSI, mid-market IT services and any enterprise with significant VMware footprint.
Akira's hallmark is rapid privilege escalation through Active Directory followed by hypervisor compromise. Once they own the ESXi host, they encrypt all VMs simultaneously, no individual VM recovery possible. The 2025 Indian fintech incidents traced to Akira saw 100% production downtime for 5-9 days.
Play, Royal, 8Base, Medusa
These groups round out the top tier of ransomware threats to Indian businesses in 2026. They share similar TTPs (exploit kits + credential abuse + lateral movement + double extortion), with sector specialization differences.
- Play: heavy focus on healthcare and education. Exploits ProxyNotShell, ConnectWise ScreenConnect bugs.
- Royal: emerged from Conti remnants. Targets mid-market enterprises across Indian manufacturing and logistics.
- 8Base: opportunistic, leverages exposed services. Higher Indian SMB volume but lower average ransom.
- Medusa: targets BFSI and government suppliers. Russian-speaking affiliates with Indian-language phishing capabilities.
- Indian-language-focused affiliates: smaller groups using Hindi/Tamil/Marathi phishing lures, targeting Indian SMEs. Lower technical ceiling but high volume.
How They Get In: The Top 5 Entry Vectors
In 95% of Indian ransomware incidents we have investigated, the entry vector falls into one of five categories. Closing these dramatically reduces exposure:
- Exposed RDP/VPN with no MFA: most preventable, most common. Single highest-leverage fix.
- Unpatched edge devices: Fortinet FortiOS, Citrix NetScaler, Ivanti, ConnectWise ScreenConnect. Patch within days of CVE publication, not weeks.
- Phished credentials: especially business email accounts that double as SSO. MFA + phishing-resistant authentication (FIDO2 keys).
- Supply chain compromise: see our supply chain attack guide.
- Misconfigured cloud: exposed S3, public Azure storage, leaky databases. Continuous CSPM monitoring catches these.
Managed SOC + IR Retainer
24x7 monitoring with named Indian-based analysts plus a pre-negotiated incident response retainer. Detection in hours, not days.
See Managed SOC →The Defense Baseline That Actually Works
Sophisticated ransomware groups bypass sophisticated defenses. But the vast majority of Indian ransomware incidents could have been prevented by a tight execution of the baseline. Get these right:
- MFA on every external service, no exceptions. VPN, email, admin portals, SaaS apps.
- EDR in active prevention mode with tested isolation capability
- Edge device patching SLA: critical CVEs within 7 days
- Network segmentation: workstations cannot reach servers freely, OT/IT separation
- Immutable backups stored offline or in object-lock storage. Tested recovery quarterly.
- Privileged access management: just-in-time admin, separation of duties, monitored sessions
- 24x7 monitoring via in-house SOC or managed service. 8-day dwell time gives ample detection window.
When Prevention Fails: Incident Response
Even mature defenses fail occasionally. What separates a contained incident from a 2-week shutdown is the speed and quality of response. Indian enterprises that handle ransomware best have:
- Pre-negotiated IR retainer with a credible firm. Hours matter.
- Tested isolation playbook: when to disconnect, who decides, who executes
- Pre-staged communications: customer, employee, regulator, media templates
- Backup recovery runbook tested in the last 90 days
- Legal counsel familiar with DPDP Act 2023 breach notification (72 hours)
- Crisis management training for the leadership team
- No-ransom policy set in advance by the Board, payments perpetuate the problem
Frequently Asked Questions
Should we pay the ransom if encrypted?
Strongly recommended against. Payment funds future attacks, has no guarantee of decryption, and increasingly may violate sanctions law (depends on the threat actor and jurisdiction). DPDP Act and forthcoming Indian regulations also disfavor payment. Focus on recovery via tested backups.
How quickly can a ransomware attack go from foothold to full encryption?
Industry median is 8 days dwell time. Sophisticated groups (LockBit, Akira) can compress to 24-48 hours when motivated. Less sophisticated groups linger weeks. SOC monitoring shrinks the detection window dramatically.
What is the most cost-effective ransomware defense investment?
MFA on every external-facing service. Costs almost nothing, prevents the largest single category of initial access. Second-most: edge device patching SLA enforced by management. Third: EDR with active prevention. These three together stop perhaps 80% of attempts.
Are cyber insurance policies useful against ransomware?
Yes but with significant exclusions. Read the policy carefully: nation-state exclusions, war exclusions, known-vulnerability exclusions, payment-not-covered-without-approval. Insurance is a backstop, not a substitute for controls. Insurers increasingly require demonstrated security maturity for coverage.
How does the DPDP Act affect ransomware response?
Breach notification to the Data Protection Board is required within stipulated time when personal data is affected, which is essentially always for ransomware in operational environments. Pre-built breach response runbooks aligned with DPDP timelines are critical. Document everything for the inevitable regulator inquiry.
Should small Indian businesses worry about ransomware?
Yes. While small businesses get less attention from top-tier groups, opportunistic affiliates and Indian-language-focused crews actively target SMEs. Average ransom for an SME: INR 30-80 lakh. Average business impact (downtime + recovery): INR 1-3 crore. A INR 5-10 lakh annual security investment dramatically reduces the risk.
How often should we test our backup recovery?
Quarterly at minimum. Full disaster-recovery exercise annually. Backups that have never been tested are not backups, they are hopes. Most failed recoveries we have investigated were from untested backup procedures, not from broken backups themselves.
Stop Ransomware Before It Stops You
Codesecure is ISO/IEC 27001:2022 certified. We run managed SOC, incident response retainers, and proactive ransomware-readiness programs for Indian enterprises. Named consultants, fixed-price engagements.
