Ransomware Threatens South Asia's Critical Infrastructure

Executive Summary

Ransomware attacks have escalated in South Asia, with cybercriminal groups targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks pose significant threats to national security and economic stability.

Current Threat Landscape

Between January and September 2025, global ransomware incidents targeting critical industries increased by 34% compared to the previous year. Notably, 50% of these attacks affected sectors vital to national resilience, including manufacturing, healthcare, energy, transportation, and finance. (prnewswire.com)

Key Threat Actors

• Qilin: A Russian-speaking cybercrime group known for its ransomware-as-a-service (RaaS) model, Qilin has been active since at least 2022. The group offers affiliates services such as double extortion, legal guidance, encryption tooling, and technical support. In June 2025, Qilin was responsible for 86 incidents, surpassing all other ransomware operators by a margin of over 50 victims. (orpheus-cyber.com)

• Royal (BlackSuit): Formed in 2022 and rebranded as BlackSuit in 2024, this group employs aggressive targeting and high ransom demands, ranging from $1 million to $10 million in Bitcoin. Royal has targeted various critical infrastructure sectors, including chemicals, communications, critical manufacturing, dams, defense industrial bases, financial services, emergency services, healthcare, nuclear reactors, waste, and materials sectors. (en.wikipedia.org)

Targeted Sectors in South Asia

• Power Grids and Water Systems: While specific incidents in South Asia are limited, the global trend indicates a rising threat to energy and water utilities. For instance, the BAUXITE group has targeted entities in the electric and water sectors across various regions. (cdotimes.com)

• Industrial Control Systems (ICS): The Pipedream malware framework, also known as Incontroller, has been identified as a "Swiss Army knife" for hacking ICS. Developed by state-level Advanced Persistent Threat actors, Pipedream targets programmable logic controllers (PLCs) and ICS, posing significant risks to critical infrastructure. (en.wikipedia.org)

• Healthcare Sector: The Qilin group has been linked to ransomware attacks on hospitals in London, demonstrating the group's capability to target healthcare institutions. Between January and April 2025, Qilin ransomed 18 publicly disclosed victims in the healthcare sector. (en.wikipedia.org)

• Financial Sector: The financial sector remains a prime target for ransomware groups due to its critical role in the economy. While specific incidents in South Asia are not detailed, the global trend indicates a rising threat to financial institutions. (prnewswire.com)

Recommendations

• Enhanced Cybersecurity Measures: Organizations should implement robust cybersecurity protocols, including regular system updates, employee training, and incident response plans.

• Collaboration and Information Sharing: Governments and private sectors should collaborate to share threat intelligence and best practices to strengthen defenses against ransomware attacks.

• Regulatory Frameworks: Establishing and enforcing cybersecurity regulations can help organizations prioritize and implement necessary security measures.

Conclusion

Ransomware attacks targeting critical infrastructure in South Asia are on the rise, with groups like Qilin and Royal posing significant threats. Proactive measures, collaboration, and regulatory frameworks are essential to mitigate these risks and protect national security and economic stability.

Highlights:

• Global Ransomware Attacks Against Critical Industries Surge 34% in 2025, Published on Monday, October 20
• Global Ransomware Attacks Against Critical Industries Surge 34% in 2025 | Manufacturing Business Technology, Published on Tuesday, October 28