CYFIRMA Report: Persistent Espionage and Identity Attacks Target India’s Government and Defence Sector
Summary
CYFIRMA’s January–August 2026 assessment says India’s government and defence sector faced persistent cyber threats, led by nation-state espionage and identity compromise, with ransomware, supply-chain risks and AI-assisted activity also highlighted.
Key points
- CYFIRMA identifies nation-state espionage, especially by China- and Pakistan-aligned groups, as the primary strategic threat to India’s government and defence ecosystem.
- Phishing, credential theft, valid-account abuse and trusted third-party access are prominent initial-access methods; internet-facing applications are also targeted.
- The report says observed ransomware incidents rose from 9 in April to 29 in August 2026, with data theft and public exposure adding pressure beyond encryption.
- Identity infrastructure, privileged accounts, supply chains and critical infrastructure are highlighted as priorities for future targeting.
- AI-assisted capabilities are described as increasingly used for reconnaissance, phishing and social engineering, while autonomous operations remain an emerging capability.
- The report recommends identity-centric security, intelligence-led defence, stronger supply-chain assurance and improved cyber resilience.
Article Details
- Publisher
- CYFIRMA
- Report Period
- January–August 2026
- Scope
- Cyber threat landscape affecting India's Government and Defence ecosystem.
- Key Statistics
- Observed ransomware incidents rose from 9 in April to 29 in August 2026; CYFIRMA describes activity as increasing sharply during the second half of the reporting period.
- CYFIRMA identifies Thegentlemen as having the highest observed ransomware targeting activity, followed by krybit, sinobi, and dragonforce.
- Recommendations
- Shift security investments toward protecting identities, privileged access, and authentication infrastructure.
- Integrate cyber threat intelligence into strategic planning, risk management, and operational decision-making.
- Strengthen security governance across contractors, technology providers, and other third parties.
- Enhance resilience of nationally significant infrastructure through continuous monitoring and risk-based security investments.
- Develop governance, detection, and response capabilities for AI-enabled cyber operations.
Threat Actors
APT36Listed as a Pakistan-aligned espionage actor; the report also identifies a Pakistan-aligned espionage campaign as APT36.APT41Listed as a China-aligned nation-state espionage group targeting India's Government and Defence ecosystem.DragonForceListed among ransomware groups targeting Indian entities, after Thegentlemen in observed activity.KrybitListed among ransomware groups targeting Indian entities, after Thegentlemen in observed activity.Mustang PandaListed as a China-aligned nation-state espionage group targeting India's Government and Defence ecosystem.sinobiListed among ransomware groups targeting Indian entities, after Thegentlemen in observed activity.The GentlemenIdentified by CYFIRMA as the ransomware group with the highest observed targeting activity during January–August 2026.Transparent TribeNamed parenthetically with APT36 in the report's description of a Pakistan-aligned espionage campaign.
Malware
AsyncRATRemcos RAT, AsyncRAT, Quasar RAT, Cobalt StrikeCobalt StrikeRemcos RAT, AsyncRAT, Quasar RAT, Cobalt StrikeDarkGateDarkGate,LokiBot,LokiBotDarkGate,LokiBot,Lumma StealerLumma Stealer, RedLine StealerPlugXPlugX, XWorm, Web ShellQokBotSmokeLoader,QokBotQuasar RATRemcos RAT, AsyncRAT, Quasar RAT, Cobalt StrikeRedLine StealerLumma Stealer, RedLine StealerRemcos RATRemcos RAT, AsyncRAT, Quasar RAT, Cobalt StrikeSmokeLoaderSmokeLoader,QokBotXWormPlugX, XWorm, Web Shell