Mercenary Spyware and Ransomware Groups in South Asia: A Rising Threat

Introduction

As of March 2026, South Asia is witnessing a surge in cyber threats, particularly from ransomware groups employing mercenary spyware, exploit brokers, and commercial offensive tools. These actors are increasingly targeting critical infrastructure and sensitive data, necessitating heightened vigilance and robust cybersecurity measures.

Emerging Ransomware Groups and Their Tactics

The region has seen the emergence of several ransomware groups that operate with sophisticated techniques:

• CyberVolk: A pro-Russian hacktivist collective and Ransomware-as-a-Service (RaaS) operator, CyberVolk has claimed responsibility for over 120 attacks against government ministries, defense contractors, scientific institutes, and critical infrastructure operators across six continents. (en.wikipedia.org)

• Kazu: An emerging ransomware and data-extortion group first observed in mid-2025, Kazu has rapidly gained traction against government, healthcare, financial services, and public sector targets globally. The group employs a double-extortion model, exfiltrating significant volumes of sensitive data before deploying ransomware linked to LockBit variants to encrypt victim systems. (tatacommunications.com)

Utilization of Mercenary Spyware and Exploit Brokers

Ransomware groups are increasingly leveraging mercenary spyware and exploit brokers to enhance their operations:

• Exploit Brokers: The Ransomware-as-a-Service (RaaS) industry continues to thrive, with the Initial Access Broker market playing a key role in the ransomware ecosystem in the Asia-Pacific region. In 2023, the RaaS market consolidated, with active groups declining due to market saturation. However, the market remains an active threat, with groups like Bitwise Spider (LockBit), Alpha Spider (ALPHAV/BlackCat), and Graceful Spider (Cl0p) being the most active, accounting for significant percentages of attacks in the region. (interpol.int)

• Commercial Offensive Tools: Cybercriminals are employing sophisticated phishing techniques that utilize hidden prompts in emails to bypass AI security systems. These tactics exploit vulnerabilities like Follina, leading to the execution of malicious payloads. (cyware.com)

Red Team Frameworks and Surveillance-as-a-Service

The adoption of red team frameworks and surveillance-as-a-service models is on the rise:

• Red Team Frameworks: MalTerminal, the earliest known malware incorporating GPT-4 capabilities, exemplifies a new category of threats known as LLM-embedded malware. This malware can dynamically generate ransomware code or reverse shell commands, posing significant challenges for cybersecurity defenses. (cyware.com)

• Surveillance-as-a-Service: Hackers are using a fake Android app named 'SafeChat' to infect devices with spyware malware that steals call logs, texts, and GPS locations from phones. (thecyberwire.com)

Conclusion

The cyber threat landscape in South Asia is evolving rapidly, with ransomware groups increasingly leveraging mercenary spyware, exploit brokers, and advanced offensive tools. This trend underscores the need for enhanced cybersecurity measures, international cooperation, and continuous monitoring to mitigate the risks posed by these sophisticated cyber adversaries.