Seqrite’s India Cyber Threat Report 2026 Records 265.52 Million Detections
Report discovered via Awesome Annual Security Reports.
Summary
Seqrite reports 265.52 million detections across more than 8 million Indian endpoints from October 2024 to September 2025. Findings highlight persistent legacy malware, ransomware campaigns, cloud identity abuse, and security-readiness gaps.
Key points
- Seqrite’s telemetry covered October 2024 through September 2025; detection counts represent observed threat activity, not a count of confirmed breaches.
- Trojans and file infectors led reported malware volumes, with approximately 88.44 million and 71.09 million detections respectively. Legacy Windows malware and shortcut-based propagation remained prominent.
- Behaviour-based antivirus and anti-ransomware engines recorded more than 34 million detections involving anomalous execution, encryption activity, and fileless intrusion techniques.
- Ransomware activity peaked in January 2025 at 185 incidents and more than 113,000 detections, which Seqrite associated with Xelera and Weaxor campaigns.
- Observed exploitation targeted WordPress plugins, Langflow, Apache Tomcat, and SysAid, highlighting exposure in internet-facing applications, middleware, and AI development infrastructure.
- A preparedness survey involving more than 180 organisations found that 39.8% still operated end-of-life systems, 27.6% lacked an incident-management process, and only 33.7% continuously monitored their attack surface.
- The report recommends faster patch deployment, stronger MFA and OAuth governance, removable-media restrictions, and integrated endpoint, cloud, identity, and network monitoring.
Article Details
- Publisher
- Seqrite
- Report Period
- October 2024–September 2025; includes selected developments from October 2025
- Scope
- Threat telemetry across India, selected global threat investigations, and an organizational cybersecurity maturity survey.
- Sample Size
- More than 8 million monitored endpoints in India; over 180 organizations participated in the cybersecurity maturity survey.
- Key Statistics
- Seqrite recorded 265.52 million detections across more than 8 million endpoints between October 2024 and September 2025, averaging 505 detections per minute.
- Behavior-based NGAV and Anti-Ransomware engines identified over 34 million detections during the reporting period.
- January 2025 had the highest reported ransomware activity, with 185 incidents and over 113,000 detections.
- Among survey participants, 39.8% still operated End-of-Life or End-of-Support systems.
- The surveyed sample received a cybersecurity maturity score of 6.3/10.
- Recommendations
- Automate patch orchestration and vulnerability prioritization across hybrid infrastructure.
- Apply Zero Trust principles, enforce strong MFA, and monitor credential replay, token abuse, and privilege escalation.
- Disable Windows autorun, restrict shortcut execution from removable and shared drives, and enforce USB device controls.
- Implement AI security governance, model integrity validation, and adversarial data testing.
- Develop cyber crisis playbooks, conduct breach simulations, and track Mean Time to Remediate.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | phpsymfony[.]com | C2 domain used in Operation HollowQuill, which targeted Russian research networks. |
MITRE ATT&CK
T1027.003 · SteganographySteganoAmor malspam embedded malware payloads inside apparently benign JPG images.T1055.004 · Asynchronous Procedure CallOperation HollowQuill deployed a Golang shellcode loader into the OneDrive process through APC injection.T1055.012 · Process HollowingThe SnakeKeylogger infection chain used InstallUtil.exe process hollowing.T1059.001 · PowerShellWeaxor and other investigated threats used PowerShell commands to download and execute encoded payloads.T1098.001 · Additional Cloud CredentialsThe report describes exploitation of SureTriggers/OttoKit authentication bypass to create rogue administrator accounts.T1190 · Exploit Public-Facing ApplicationAttackers exploited internet-facing applications including Langflow, Apache Tomcat, SysAid, and SAP NetWeaver.T1486 · Data Encrypted for ImpactXELERA, Weaxor, and WantToCry encrypted victim files to demand ransom.T1496 · Resource HijackingAttackers hijacked SQL servers and other enterprise compute resources for cryptocurrency mining.T1505.003 · Web ShellAttackers deployed webshells following Apache Tomcat and SAP NetWeaver exploitation.T1543.004 · Launch DaemonZuRu and XCSSET maintained macOS persistence through LaunchDaemon tasks.T1547.001 · Registry Run Keys / Startup FolderOperation HollowQuill maintained persistence using Windows Startup shortcuts.T1562.001 · Disable or Modify ToolsTrojan.KillAv.DR disables antivirus processes, while Weaxor infection chains included AMSI bypass.T1566.001 · Spearphishing AttachmentMultiple investigations describe spear-phishing attachments, including malicious archives, research PDFs, and shortcut files.T1566.004 · Spearphishing VoiceAttackers impersonated IT staff through vishing to obtain approval for a malicious OAuth application in the Google Salesforce breach.T1574.002 · DLL Side-LoadingSideCopy infection chains and the Swan Vector investigation explicitly involved DLL sideloading.
CVE
CVE-2010-2568- **Update Legacy Systems and Patches**: Apply security updates that fix known shortcut parsing flaws (e.g., CVE-2010-2568) to eliminate long-standing exploit vectors.CVE-2025-11001### 4. 7-Zip Symbolic-Link Vulnerabilities (CVE-2025-11001 & 11002)CVE-2025-20352### 3. Cisco SNMP “Zero Disco” (CVE-2025-20352)CVE-2025-24813- **Vulnerability:** CVE-2025-24813 – Path Equivalence / Partial PUT ExploitCVE-2025-2775- **Vulnerability:** CVE-2025-2775 – XML External Entity InjectionCVE-2025-3102- **Vulnerability:** CVE-2025-3102 – SureTriggers/OttoKit Authentication BypassCVE-2025-31324Mass RCE Attacks (CVE-2025-31324)CVE-2025-3248- **Vulnerability:** CVE-2025-3248 – Unauthenticated RCE through API endpointCVE-2025-32711The EchoLeak exploit (CVE-2025-32711) demonstrates how attackers can abuse AI assistants like Microsoft 365CVE-2025-44148- **Vulnerability:** CVE-2025-44148 – Reflected XSS (`failure.aspx`)CVE-2025-54253### 5. Adobe AEM Forms (CVE-2025-54253)CVE-2025-59230### 2. Microsoft Windows Core (CVE-2025-59230 / 24990 / 47827)CVE-2025-61882### 1. Oracle E-Business Suite (CVE-2025-61882)CVE-2025-6218Directory Traversal & NTFS ADS (CVE-2025-6218 & CVE-2025-8088)CVE-2025-8088Directory Traversal & NTFS ADS (CVE-2025-6218 & CVE-2025-8088)
People
Dr. Kailash KatkarChairman and Managing Director of Quick Heal Technologies Ltd; contributed a report foreword.Dr. Sanjay KatkarJoint Managing Director of Quick Heal Technologies Ltd.; contributed a report foreword.Jyoti KarlekarListed report author and Senior Content Writer.Priyabrata DashListed report author and Manager - Engineering.Shayak TarafdarListed report author and Sr. Manager - Engineering.
Threat Actors
AkiraIdentified among major ransomware groups affecting the global and Indian threat landscape.APT36Seqrite attributes participation in Operation Sindoor to this group, alongside SideCopy and hacktivist collectives.Cl0pIdentified among ransomware groups dominating Indian activity; the report separately attributes Oracle E-Business Suite exploitation to CL0P-linked actors.Cyber Error SystemReported to conduct DDoS, phishing, and defacement attacks against Indian government and media entities.INDOHAXSECReported to conduct DDoS, phishing, and defacement attacks against Indian government and media entities.QilinIdentified among major ransomware groups affecting the global and Indian threat landscape.ShinyHuntersCollective linked by the report to UNC6040 and UNC6240; also reported to automate exploitation of SAP NetWeaver.SideCopyPakistan-linked APT reported to target Indian sectors using malicious MSI installers, shortcut files, and remote access payloads.UNC6040Reported participant in the June 2025 Google Salesforce cyber-extortion breach; described as linked to ShinyHunters.UNC6240Reported participant in the June 2025 Google Salesforce cyber-extortion breach; described as linked to ShinyHunters.
Malware
Ares RATand malware-laced lure files to infiltrate defense and government IT systems. The introduction of Ares RAT, a modular and evasive remote access tool, enabled persistent surveillance and data exfiltration.MassLoggerMasslogger Fileless VariantSparkKitty### 4. SparkKitty SpywareTrojan.Floxif.E5Families like `Trojan.Agent`, `Trojan.Floxif.E5`, and `Trojan.KillAv.DR` demonstrate modular evolution—each designed to deploy, disable, or adapt. Once a system is compromised, these trojans establish persistence,Trojan.KillAv.DRengineering-based intrusions leveraging fake tenders and invoice attachments. Malware such as `Trojan.KillAv.DR` and `Hacktool.Keygen` were prevalent, indicating a shift toward industrial espionage and financialTrojan.NSIS.Miner.SD`Nsis.Bitmin` and `Trojan.NSIS.Miner.SD` represented the stealthier monetization vector of 2025. Attackers now deploy miners that automatically adapt CPU usage to avoid detection. The combination of miner payloads andW32.Expiro.R3Dominant variants such as `W32.Pioneer.CZ1`, `Trojan.Agent`, and `W32.Expiro.R3` leveraged phishing attachments, weaponized documents, and compromised websites.WantToCryrelatively small, but the impact per incident was severe. Modern strains like Weaxor, Xelera, and WantToCry used multi-extortion tactics, combining encryption, data theft, and public leaks. Most infectionsWeaXorActivity peaked in January 2025, with 185 incidents and 113,000 detections, driven by campaigns like Xelera and Weaxor.XELERAActivity peaked in January 2025, with 185 incidents and 113,000 detections, driven by campaigns like Xelera and Weaxor.
Vendors
Products
7-Zip### 4. 7-Zip Symbolic-Link Vulnerabilities (CVE-2025-11001 & 11002)Adobe AEM Forms### 5. Adobe AEM Forms (CVE-2025-54253)Apache TomcatOn the exploitation front, network-based attacks targeting WordPress Plugins, Apache Tomcat, and SysAid reflected continued exploitation of poor patch hygiene, while LNK-based host exploits reaffirmed that simpleCisco IOS/XEA remote-code flaw in Cisco IOS/XE devices used to implant rootkits for long-term persistence & network monitoring.LangflowEmerging attack surfaces such as AI frameworks (Langflow) and cloud consoles indicate a shift toward targeting development and automation layers, signaling the beginning of AI stack exploitation.MailEnable#### MailEnable XSS: Phishing Through InfrastructureMicrosoft 365 Copilot“EchoLeak” Exploits Microsoft 365 Copilot for Data ExfiltrationMicrosoft Windows Core### 2. Microsoft Windows Core (CVE-2025-59230 / 24990 / 47827)Oracle E-Business SuiteAdditionally, the surge in zero-day weaponization from Oracle E-Business Suite to Cisco IOS demonstrates that patch latency remains one of the most exploited weaknesses across enterprises.SAP NetWeaver Development ServerExploit Targeting SAP NetWeaver Development ServerSureTriggers/OttoKit- **Vulnerability:** CVE-2025-3102 – SureTriggers/OttoKit Authentication BypassSysAidOn the exploitation front, network-based attacks targeting WordPress Plugins, Apache Tomcat, and SysAid reflected continued exploitation of poor patch hygiene, while LNK-based host exploits reaffirmed that simpleWinRARWinRAR Vulnerabilities
Tools
Cobalt Strike• A Cobalt Strike beacon establishes long-term remote control.HackBrowserDataUsing modified tools like HackBrowserData and persistence via LaunchDaemons and Git repositories, XCSSETMullvadthrough Mullvad VPN and TOR.PacketCryptloads. Attackers deployed PacketCrypt mining tools through Base64 PowerShell commands and Themida-packedThemidaloads. Attackers deployed PacketCrypt mining tools through Base64 PowerShell commands and Themida-packedTorthrough Mullvad VPN and TOR.
Countries
China- **Region:** Southeast Asia, ChinaIndia# India Cyber Threat Report 2026JapanTargeting Taiwan and Japan with Varied DLL ImplantsKazakhstanAttribution suggests overlap with YoroTrooper operations from Kazakhstan.KyrgyzstanTargeting Entities Across KyrgyzstanPakistanThe SideCopy APT group, linked to Pakistan, has evolved its infection strategy — shifting from HTA-based to MSIRussiaOperation HollowQuill targeted the Baltic State Technical University (BSTU) in Russia using malicious researchTaiwanTargeting Taiwan and Japan with Varied DLL ImplantsUnited StatesAs the first Indian cybersecurity-focused company to join the United States Artificial Intelligence Safety Institute Consortium, we advance responsible AI development and safer global digital ecosystems.
Industries
Construction & Real Estate### 8. Construction & Real Estate (918K detections | 2.80%)Consumer Goods & Retail### 9. Consumer Goods & Retail (918K detections | 2.28%)Education & Training### 1. Education & Training (4.92M detections | 18.45%)Energy & UtilitiesWest Bengal’s threat density is driven by its exceptionally large Energy & Utilities sector (159,983 units), Media & Entertainment (192,077 units), major government networks, and public-service institutions that areEngineering & Manufacturinghighest threat activity, supported by one of India’s largest digital estates, including 556K+ engineering & manufacturing units, 1.5M+ healthcare entities, 473K+ IT & software units, and 765K+ education institutions,Financial Servicesin its high-value concentration of 231K+ education entities, 20.9K+ media organisations, 65K+ financial services units, and critical government infrastructure, making it continuously attractive for threat actors.GovernmentSeqrite Labs, India’s largest malware analysis centre monitoring over 8 million endpoints, has tracked and analysed this surge, providing actionable intelligence to enterprises, government institutions, and citizens.Healthcare & Pharmaceuticals### 2. Healthcare & Pharmaceuticals (3.79M detections | 14.24%)Information Technology & Software### 5. Information Technology & Software (2.76M detections | 10.35%)Metals, Mining & Materials### 6. Metals, Mining & Materials (1.23M detections | 4.62%)