Mercenary Spyware and Ransomware Groups in South Asia: A Rising Threat

Introduction

In early 2026, South Asia has witnessed a surge in cyber threats, particularly from ransomware groups employing mercenary spyware and commercial offensive tools. These actors are increasingly targeting critical infrastructure, government entities, and private sectors, posing significant risks to the region's cybersecurity landscape.

Emergence of Ransomware Groups in South Asia

Several ransomware groups have intensified their operations in South Asia, utilizing sophisticated tactics and tools:

• Qilin: Maintaining its dominance, Qilin has been responsible for 104 attacks in February 2026, with five confirmed incidents. (comparitech.com)

• The Gentlemen: Close behind, The Gentlemen claimed 84 attacks in the same period, with an equal number of confirmations. (comparitech.com)

• Gunra: A newly discovered group identified in April 2025, Gunra operates on both Windows and Linux systems, with its Linux variant supporting up to 100 concurrent encryption threads. (download.ahnlab.com)

Utilization of Mercenary Spyware and Commercial Offensive Tools

Ransomware groups are increasingly integrating mercenary spyware and commercial offensive tools into their operations:

• Medusa Ransomware: Medusa has been observed using a malicious driver called ABYSSWORKER in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable endpoint protections. (cyware.com)

• KillSec: Operating since October 2023, KillSec implements operations primarily driven by a pro-Russian and retaliatory political agenda, frequently aligning its cyberattacks with Russian geopolitical interests. (akamai.com)

Targeted Sectors and Geographies

The primary targets of these ransomware groups include:

• Healthcare: Medusa and KillSec have shown a particular interest in targeting the healthcare industry, followed by finance and government entities. (akamai.com)

• Critical Infrastructure: CyberVolk, a pro-Russian hacktivist group, has targeted critical infrastructure, government entities, and scientific institutions, collaborating with other hacktivist and pro-Russian groups. (akamai.com)

• Geographical Focus: While these groups operate globally, there is a notable emphasis on regions such as South Asia, with countries like India and Bangladesh being frequent targets. (akamai.com)

Implications and Recommendations

The integration of mercenary spyware and commercial offensive tools by ransomware groups in South Asia signifies a concerning trend towards more sophisticated and targeted cyberattacks. To mitigate these threats, organizations should:

• Enhance Cyber Hygiene: Regularly update systems and software to patch vulnerabilities.

• Implement Robust Security Measures: Deploy advanced endpoint protection solutions capable of detecting and mitigating sophisticated malware.

• Conduct Regular Security Audits: Identify and address potential security gaps within organizational networks.

• Promote Cybersecurity Awareness: Educate employees about phishing schemes and safe online practices.

By adopting a proactive and comprehensive cybersecurity strategy, organizations in South Asia can better defend against the evolving threat landscape posed by ransomware groups leveraging mercenary spyware and commercial offensive tools.

Highlights:

• Ransomware roundup: February 2026 - Comparitech, Published on Monday, March 02
• All eyes to the East: The rise of ransomware in Asia, Published on Tuesday, January 20
• V11 ISSUE 03, Published on Friday, November 28