Ransomware Threatens South Asia's Critical Infrastructure Amid Rising Attacks

Executive Summary

In early 2026, South Asia has witnessed a significant surge in ransomware attacks targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. This trend poses substantial national security risks, highlighting the need for enhanced cybersecurity measures across the region.

Ransomware Surge in Critical Sectors

Between January and September 2025, global ransomware incidents increased by 34%, with 50% of these attacks targeting critical infrastructure sectors, including manufacturing, healthcare, energy, transportation, and finance. (prnewswire.com) Notably, manufacturing experienced a 61% year-over-year increase in attacks. While these statistics are global, South Asia has mirrored this escalation, with significant incidents reported in the region.

Targeted Sectors in South Asia

• Power Grids and Water Systems: Ransomware groups have increasingly targeted energy and water infrastructure, aiming to disrupt essential services and demand ransoms. The 2025 cyberattack on the Polish power grid serves as a stark reminder of the potential impact such attacks can have on national infrastructure. (en.wikipedia.org)

• Industrial Control Systems (ICS): The manufacturing sector has been particularly vulnerable, with a 61% increase in attacks year-over-year. Ransomware groups exploit vulnerabilities in ICS to halt production and demand ransoms. (prnewswire.com)

• Healthcare Sector: Hospitals and healthcare providers have been prime targets, with ransomware attacks leading to data breaches and operational disruptions. The reliance on interconnected systems makes healthcare organizations particularly susceptible.

• Financial Sector: Banks and financial institutions have faced increased ransomware threats, with attackers aiming to steal sensitive financial data and disrupt services. The financial sector's critical role in the economy makes it a high-value target for cybercriminals.

Notable Threat Actors

Several ransomware groups have been identified as active in South Asia:

• Qilin: Responsible for 13% of global ransomware attacks in 2025, Qilin has targeted various sectors, including critical infrastructure. (nccgroup.com)

• BQT.Lock: Emerging in mid-2025, BQT.Lock operates from the Middle East and has been linked to attacks on U.S. companies. The group blends financial extortion with ideological motives, potentially indicating state-sponsored activities. (en.wikipedia.org)

Implications and Recommendations

The rise in ransomware attacks targeting critical infrastructure in South Asia underscores the need for robust cybersecurity measures. Organizations should implement comprehensive security protocols, conduct regular vulnerability assessments, and ensure rapid response capabilities to mitigate potential disruptions. Collaboration between governments, private sectors, and international partners is essential to strengthen defenses against these evolving cyber threats.

The evolving threat landscape necessitates continuous monitoring and adaptation of cybersecurity strategies to safeguard critical infrastructure and maintain national security.

Highlights:

• Global Ransomware Attacks Against Critical Industries Surge 34% in 2025 | Manufacturing Business Technology, Published on Tuesday, October 28
• Significant Rise in Ransomware Attacks Targeting Industrial Operations - Infosecurity Magazine, Published on Monday, February 16
• Researchers report increased ransomware and hacktivist activities targeting industrial systems in 2025 | Digital Watch Observatory, Published on Monday, January 19