Ransomware Threatens South Asia's Critical Infrastructure

Executive Summary

As of March 2026, ransomware groups have escalated their attacks on critical infrastructure across South Asia, focusing on sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. This surge in cyberattacks poses substantial risks to national security and economic stability in the region.

Key Threat Actors

• Qilin: A Russian-speaking cybercrime organization, Qilin has been active since at least 2022. They have developed the 'Agenda' ransomware, which has been tailored by affiliates to target various industries, including healthcare, manufacturing, and financial services. In 2025, Qilin was responsible for 9% of global ransomware attacks, with a significant portion targeting critical infrastructure sectors. (blog.checkpoint.com)

• Royal (BlackSuit): Formed in 2022 and rebranded as BlackSuit in 2024, this group is known for its aggressive targeting and high ransom demands. Royal has attacked a wide range of industries, including healthcare, finance, and critical infrastructure, with ransom demands typically ranging from $1 million to $10 million in Bitcoin. (en.wikipedia.org)

Recent Attack Trends

Between January and September 2025, ransomware attacks targeting critical industries increased by 34% year-over-year. Notably, manufacturing saw a 61% surge in attacks during this period. The United States was the most affected, accounting for approximately 21% of global ransomware activity, followed by Canada, Germany, the U.K., and Italy. (mbtmag.com)

Targeted Sectors in South Asia

• Power Grids and Water Systems: While specific incidents in South Asia are limited, the global trend indicates a rising threat to energy and utility sectors. For instance, the BAUXITE group has targeted entities in the energy, water, and chemical manufacturing sectors across various regions. (cdotimes.com)

• Industrial Control Systems (ICS): The Pipedream malware framework, also known as Incontroller, has been identified as a tool capable of targeting ICS. Developed by state-level Advanced Persistent Threat actors, Pipedream is designed to exploit vulnerabilities in ICS, posing significant risks to critical infrastructure. (en.wikipedia.org)

• Healthcare Sector: Ransomware groups like Qilin have targeted healthcare organizations, with 18 publicly disclosed victims between January and April 2025. These attacks often involve double extortion techniques, where data is both encrypted and exfiltrated. (flashpoint.io)

• Financial Sector: The financial sector remains a prime target for ransomware groups due to the high potential for financial gain. While specific incidents in South Asia are not detailed, the global trend indicates a significant threat to this sector.

Implications and Recommendations

The increasing frequency and sophistication of ransomware attacks on critical infrastructure in South Asia necessitate immediate and coordinated responses. Organizations must implement robust cybersecurity measures, including regular system updates, employee training, and incident response planning. Additionally, regional collaboration is essential to share threat intelligence and develop collective defense strategies.

Conclusion

Ransomware groups pose a high-level threat to South Asia's critical infrastructure, with potential consequences for national security and economic stability. Proactive measures and regional cooperation are vital to mitigate these risks and safeguard essential services.

Highlights:

• Global Ransomware Attacks Against Critical Industries Surge 34% in 2025 | Manufacturing Business Technology, Published on Tuesday, October 28
• New Data Reveals July’s Worst Ransomware Groups and Attack Surges - Check Point Blog, Published on Sunday, August 10
• APT and financial attacks on industrial organizations in Q4 2025 | Kaspersky ICS CERT, Published on Thursday, March 05