India

The cyber threat landscape for India during this period was highly active, with significant state-sponsored and financially motivated activities. India's cybersecurity agency, CERT-In, issued a critical warning on November 4, 2026, about AI-driven cyberattacks targeting the financial sector. The agency identified a China-linked hacking group named 'Crafty Falcon' as actively and persistently using publicly available AI tools, such as ARTEX, PentAGI, Cairn, and CyberStrikeAI, to automate attacks and exploit vulnerabilities in financial institutions, including banks, non-banking lenders, fintech firms, and cryptocurrency exchanges. These attacks reportedly exploit holidays and low-monitoring windows to achieve machine-speed compromises.

Another prominent threat was the PapRAT Cyber-Espionage Campaign, attributed with high confidence to the South Asian threat group Bitter (also known as TA397). This group, active since at least 2013 and linked to India, was observed deploying a custom remote access trojan (RAT) called PapRAT against organizations across South Asia, specifically targeting government, energy, and engineering sectors. The campaign utilized three distinct infection chains involving malicious Windows shortcut (LNK) files, VHDX disk images, and URL shortcuts, often abusing native Windows utilities like ftp.exe and curl to maintain access and exfiltrate data. PapRAT, available in C++ and Rust variants, supports remote shell access, file transfers, and screenshot capture.

Several notable incidents and data breaches further underscored the pervasive cyber risks. Mirae Asset Finance Services in Navi Mumbai reported a ₹8.92 crore theft on October 28, 2026, due to exploited vulnerabilities in its automated loan disbursement system, with the incident coming to light on November 10, 2026. Separately, Mirae Asset Securities, a major South Korean financial services company with operations in India, confirmed a data breach on November 7, 2026, following unauthorized external access to its mobile web phone authentication login service and internal system on November 4-5, 2026. This breach exposed the personal information of approximately 39,000 individuals, including account numbers of 3,800 customers and personal details (names, employee IDs, emails, mobile numbers, encrypted passwords) of over 35,000 current and former employees and contractors. On November 11, 2026, Indian cybersecurity firm eMudhra released a full report on a security key incident from the previous month, revealing that a Python scripting error led to the generation of eight weak security keys, which were used to issue digital certificates. This flaw could have allowed the creation of fake websites, leading to the revocation of 16 affected certificates.

Regarding exploited vulnerabilities, the CERT-In advisory on AI-driven attacks highlighted the exploitation of unpatched software and misconfigured IT systems, specifically targeting automated disbursement APIs in financial firms. The eMudhra incident was directly linked to a "Python scripting error" that created weak security keys. While not directly exploited in new incidents this week, two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were flagged in October 2026 as critical weaknesses in India's digital infrastructure, capable of allowing unauthenticated attackers to execute arbitrary code.

In response to these threats, the Indian government's cyber policy and response included CERT-In and the Indian Cybercrime Coordination Center (I4C) issuing advisories to financial institutions. These advisories urged urgent implementation of prescribed measures, reporting cyber incidents to CERT-In within six hours, and aligning security controls with CERT-In's May 2026 blueprint for defending against AI-assisted vulnerability exploitation. Furthermore, the DRDO released IRSA Security APIs on November 10, 2026, to enhance security integration for India's indigenous software-defined radio ecosystem.

Background: Threat actors known to target India include APT29 (Russia-linked), Lazarus Group (North Korea-linked), MuddyWater (Iran-linked), Turla (Russia-linked), WIZARD SPIDER (Russia-linked), APT27 (China-linked), APT10 (China-linked), and APT15 (China-linked).