CYFIRMA Report Maps Cyber Threats Facing India and SAARC Telecom Sector

Oct 14, 2026 · Original article ↗

Summary

CYFIRMA’s April–September 2026 assessment describes telecom risks across India and SAARC, including exposed infrastructure, credential compromise, ransomware, data claims and APT threats. It recommends stronger vulnerability, identity and network defenses.

Key points

The report identifies exposed network infrastructure, compromised credentials, ransomware, supply-chain exposure and subscriber-data risks as major concerns.
Dark-web advertisements claimed large Indian telecom-related datasets, but their authenticity and provenance were not independently verified.
Researchers reported malware targeting Afghan telecom providers and other South Asian critical-infrastructure organizations; attribution to APT36 or a related actor was assessed with moderate confidence.
No SAARC-specific APT activity was observed during the assessment period; named groups are presented as monitoring priorities, not confirmed operators’ adversaries.
The report recorded 150 ransomware victims across SAARC; two Telecommunications & Media listings were attacker claims, not independently confirmed compromises.
It lists 15 high-severity vulnerabilities relevant to telecom-supporting products, while exploitation against SAARC telecom networks was not established.
Recommended priorities include patching exposed systems, enforcing MFA and least privilege, monitoring network devices, strengthening backups and correlating threat intelligence with internal telemetry.

Article Details

Publisher: CYFIRMA
Report Period: 2026-04-01 to 2026-09-30
Scope: External threat-landscape assessment of telecommunications across India and SAARC; no operator-system access or authenticated penetration testing.
Sample Size: 1,605 SAARC dark-web observations; 150 SAARC ransomware leak-site victim listings; 15 selected vulnerabilities.
Key Statistics: Telecommunications & Media accounted for 62 of 1,605 SAARC dark-web observations (3.9%) during April–September 2026; monthly observations fell from 36 in April to 0 in September.
Three underground advertisements or replies concerning alleged Indian telecom-related datasets were observed. Two sellers claimed approximately 850 million records totaling 109 GB and approximately 75 million records, respectively; authenticity, provenance and volumes were not independently verified.
Two of 150 SAARC ransomware leak-site victim listings involved Telecommunications & Media: Tikona Infinet and ratnasagar.com, both in India. These were attacker claims, not independently confirmed compromises.
CYFIRMA observed 46 ransomware groups across SAARC during April–September 2026. The Gentlemen accounted for 27 reported listings and Krybit for 18.
Five of 15 selected vulnerabilities had exploitation attributed to named actors in public reporting; exploitation against SAARC telecom networks was not established.
Recommendations: Inventory externally exposed assets, remove unnecessary exposure, restrict administrative interfaces to trusted networks, and prioritize remediation by active exploitation, exposure and business criticality.
Enforce phishing-resistant MFA and least privilege for privileged and third-party access; remove dormant accounts, rotate exposed credentials, and separate administrative accounts from normal accounts.
Monitor network devices and management platforms for unauthorized firmware or configuration changes, new accounts, unusual outbound connections and abnormal administrative activity.
Maintain isolated, protected backups, test restoration and recovery objectives, and conduct ransomware and incident-response exercises.
Correlate dark-web claims and credential intelligence with vulnerability information, authentication logs, network telemetry and incident-response evidence before treating claims as confirmed incidents.