Emerging Threats in South Asia: The Rise of Mercenary Spyware and Ransomware-as-a-Service

Introduction

As of April 2026, South Asia is confronting an escalating cyber threat landscape, characterized by the proliferation of mercenary spyware operations and the emergence of sophisticated Ransomware-as-a-Service (RaaS) groups. These developments underscore the region's increasing vulnerability to cyber exploitation and necessitate a comprehensive understanding of the evolving threat dynamics.

Mercenary Spyware Operations

Mercenary spyware groups, often operating as hack-for-hire entities, have been actively targeting organizations across South Asia. A notable example is the group known as "CostaRicto," which has been implicated in cyber-espionage campaigns targeting entities in India, Bangladesh, and Singapore. Utilizing custom backdoors like "SombRAT," these actors employ advanced phishing techniques and novel payload strategies to infiltrate systems, steal credentials, and establish persistent access. The adaptability and continuous development of their toolsets suggest a long-term operational strategy aimed at diverse targets. (cyberscoop.com)

Ransomware-as-a-Service (RaaS) Groups

The RaaS model has gained significant traction in South Asia, with several groups offering ransomware deployment services to affiliates. One such group is "CyberVolk," a pro-Russian hacktivist collective that operates as a RaaS provider. Since its inception in May 2024, CyberVolk has claimed responsibility for over 120 attacks against government ministries, defense contractors, scientific institutes, and critical infrastructure operators across multiple continents, including South Asia. Their operations are characterized by high ransom demands and the use of double extortion tactics, where both data encryption and exfiltration are employed to pressure victims into compliance. (en.wikipedia.org)

Exploit Brokers and Commercial Offensive Tools

The cyber threat ecosystem in South Asia is further complicated by the activities of exploit brokers and the availability of commercial offensive tools. Exploit brokers facilitate the sale and distribution of zero-day vulnerabilities, which are then utilized by cybercriminal groups to develop sophisticated attack vectors. The accessibility of these exploits has lowered the entry barrier for cybercriminals, enabling them to execute complex attacks with relative ease. Additionally, the proliferation of commercial red team frameworks and surveillance-as-a-service platforms has provided threat actors with advanced capabilities for network intrusion, data exfiltration, and surveillance, thereby enhancing the sophistication and scale of cyber-attacks in the region. (interpol.int)

Case Studies and Recent Incidents

Several incidents in recent years highlight the critical threat posed by these cyber actors:

• APT36/Transparent Tribe Attacks: This group has targeted Indian railway systems, oil and gas infrastructure, and the Ministry of External Affairs. Their campaigns involve advanced phishing techniques, novel payload strategies, and persistent backdoors, such as the "Poseidon" backdoor, which is built on the Mythic framework and written in Go. (ics-cert.kaspersky.com)

• Kazu Ransomware Group: Emerging in mid-2025, Kazu has rapidly gained prominence by targeting government, healthcare, financial services, and public sector entities globally. Their operations leverage a double-extortion model, exfiltrating significant volumes of sensitive data before deploying ransomware linked to LockBit variants to encrypt victim systems. (tatacommunications.com)

Implications and Recommendations

The convergence of mercenary spyware operations and RaaS groups in South Asia presents a multifaceted threat landscape. The use of exploit brokers and commercial offensive tools by these actors has significantly enhanced their capabilities, making traditional defense mechanisms less effective. To mitigate these threats, it is imperative for organizations in the region to:

• Enhance Cyber Hygiene: Regularly update systems, employ robust access controls, and conduct comprehensive security training to reduce the risk of initial compromise.

• Implement Advanced Detection Mechanisms: Deploy intrusion detection systems capable of identifying sophisticated attack vectors, including those utilizing zero-day exploits.

• Collaborate Regionally: Establish information-sharing frameworks among South Asian nations to facilitate timely dissemination of threat intelligence and coordinated response efforts.

Conclusion

The cyber threat landscape in South Asia is evolving rapidly, with mercenary spyware operations and RaaS groups at the forefront of this transformation. The integration of exploit brokers and commercial offensive tools into their arsenals has amplified the complexity and scale of cyber-attacks in the region. A proactive and collaborative approach is essential to bolster defenses and safeguard critical infrastructure against these emerging cyber threats.

Highlights:

• Hacker-for-hire group targeting South Asian organizations, research says | CyberScoop, Published on Wednesday, November 11
• APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT, Published on Sunday, November 30
• YOUR WEEKLY, Published on Tuesday, January 13