India Security Report — November 11, 2026

Security analysis based on open-source intelligence and web research. Period: November 04 — November 11, 2026.

Executive Summary

India experienced a dynamic security landscape between November 04 and November 11, 2026, marked by significant advancements in defense capabilities and intensified cyber threats. The nation made strides in military modernization with substantial defense acquisitions, including next-generation corvettes and minefield breaching equipment, alongside a strategic focus on space-based warfare. Diplomatically, India actively engaged with both the European Union and the United States, progressing towards crucial trade agreements and digital cooperation. However, the period was overshadowed by a heightened cyber threat, characterized by sophisticated AI-driven attacks targeting the financial sector by China-linked groups, a persistent PapRAT cyber-espionage campaign in South Asia, and notable data breaches affecting financial institutions. These cyber incidents underscore critical vulnerabilities in India's digital infrastructure, necessitating robust and adaptive security measures.

Key Security Developments

• Military Activities and Exercises
  An Indian Army contingent departed for Egypt to participate in the fourth edition of the India-Egypt Joint Special Forces Exercise, Cyclone-IV, scheduled from November 12 to November 17, 2026, at Anshas, Egypt. This exercise aims to enhance joint mission planning and interoperability through the exchange of best practices in special operations. On November 3, 2026, the Indian Army hosted a seminar in New Delhi titled “Emerging Battlefield: Leveraging Space for Land Forces,” bringing together experts from the Armed Forces, ISRO, DRDO, industry, and academia to discuss the growing role of space technologies in land operations, including Space Domain Awareness and secure satellite communications.

• Defense Policy and Strategic Shifts
  The Union Cabinet, chaired by Prime Minister Narendra Modi, approved a two-year extension of service for Agniveers under the Agnipath scheme on November 4, 2026. This decision creates a pathway for all Agniveers to continue serving in the armed forces beyond their initial tenure, with opportunities for permanent positions based on performance, aiming to prepare India's military for evolving warfare. A major focus of the discussions at the Indian Army's space seminar was the need to build resilient indigenous space technologies, reflecting India's broader emphasis on self-reliance in critical strategic capabilities.

• Diplomatic Relations
  India and the United States held detailed discussions on the customs and trade facilitation chapter of the proposed Bilateral Trade Agreement (BTA) in New Delhi on November 2-3, 2026. Commerce ministry officials indicated that negotiations are on track to finalize the first tranche of the pact. The outcome of the US midterm elections, which saw the Democratic Party gain full control of Congress, is viewed by some as potentially offering a window to stabilize and restore India-US ties, by providing a legislative check on protectionist policies. India also strongly rejected allegations made against National Security Adviser Ajit Doval and former Research and Analysis Wing (RAW) chief Samant Goel in a civil lawsuit filed in the United States by Khalistani terrorist Gurpatwant Singh Pannun, dismissing the claims as "fabricated and malicious".

• Defense Acquisitions and Arms Deals
  On November 2, 2026, India's Ministry of Defence signed contracts worth ₹53,866.5 crore (approximately $5.7 billion) for eight Next Generation Corvettes (Project 28A). Garden Reach Shipbuilders & Engineers (GRSE) will build five, and Goa Shipyard Limited (GSL) will build the remaining three, marking India's first fully in-house warship design. Additionally, on November 9, 2026, the Ministry of Defence signed contracts worth ₹975 crore for the procurement of TRAWL Assemblies for T-72 and T-90 tanks. These systems, developed by the Defence Research and Development Organisation (DRDO), are designed to boost the Indian Army's minefield breaching capability.

• Cybersecurity Incidents and Threats
  India's cybersecurity agency, CERT-In, issued a warning on November 4, 2026, regarding AI-driven cyberattacks targeting financial institutions, including banks, non-banking lenders, fintech firms, and cryptocurrency exchanges, by a hacking group known as 'Crafty Falcon'. Separately, a suspected South Asian cyber-espionage group, Bitter (also tracked as TA397), was observed deploying a custom remote access trojan (RAT) dubbed PapRAT against organizations across South Asia. Mirae Asset Finance Services in Navi Mumbai reported a theft of ₹8.92 crore on October 28, 2026, through vulnerabilities in its automated loan disbursement system, with the incident reported on November 10, 2026. Mirae Asset Securities, a South Korean firm with an Indian presence, confirmed a data breach on November 7, 2026, affecting approximately 39,000 customers and employees, with unauthorized access occurring on November 4-5, 2026.

• Maritime and Border Security
  An analysis published on November 11, 2026, highlighted the Strait of Malacca as India's "Ocean Lifeline," emphasizing its critical importance to the country's energy and economic security due to its role as a maritime artery for crude oil imports and container shipping.

• Defense Industry Developments
  The Defence Research and Development Organisation (DRDO) released the IRSA Security APIs on November 10, 2026, completing a key element of the Indian Radio Software Architecture (IRSA) framework. This development enables standardized security integration across India's indigenous and interoperable software-defined radio (SDR) ecosystem.

Cyber Threat Landscape

The cyber threat landscape for India during this period was highly active, with significant state-sponsored and financially motivated activities. India's cybersecurity agency, CERT-In, issued a critical warning on November 4, 2026, about AI-driven cyberattacks targeting the financial sector. The agency identified a China-linked hacking group named 'Crafty Falcon' as actively and persistently using publicly available AI tools, such as ARTEX, PentAGI, Cairn, and CyberStrikeAI, to automate attacks and exploit vulnerabilities in financial institutions, including banks, non-banking lenders, fintech firms, and cryptocurrency exchanges. These attacks reportedly exploit holidays and low-monitoring windows to achieve machine-speed compromises.

Another prominent threat was the PapRAT Cyber-Espionage Campaign, attributed with high confidence to the South Asian threat group Bitter (also known as TA397). This group, active since at least 2013 and linked to India, was observed deploying a custom remote access trojan (RAT) called PapRAT against organizations across South Asia, specifically targeting government, energy, and engineering sectors. The campaign utilized three distinct infection chains involving malicious Windows shortcut (LNK) files, VHDX disk images, and URL shortcuts, often abusing native Windows utilities like ftp.exe and curl to maintain access and exfiltrate data. PapRAT, available in C++ and Rust variants, supports remote shell access, file transfers, and screenshot capture.

Several notable incidents and data breaches further underscored the pervasive cyber risks. Mirae Asset Finance Services in Navi Mumbai reported a ₹8.92 crore theft on October 28, 2026, due to exploited vulnerabilities in its automated loan disbursement system, with the incident coming to light on November 10, 2026. Separately, Mirae Asset Securities, a major South Korean financial services company with operations in India, confirmed a data breach on November 7, 2026, following unauthorized external access to its mobile web phone authentication login service and internal system on November 4-5, 2026. This breach exposed the personal information of approximately 39,000 individuals, including account numbers of 3,800 customers and personal details (names, employee IDs, emails, mobile numbers, encrypted passwords) of over 35,000 current and former employees and contractors. On November 11, 2026, Indian cybersecurity firm eMudhra released a full report on a security key incident from the previous month, revealing that a Python scripting error led to the generation of eight weak security keys, which were used to issue digital certificates. This flaw could have allowed the creation of fake websites, leading to the revocation of 16 affected certificates.

Regarding exploited vulnerabilities, the CERT-In advisory on AI-driven attacks highlighted the exploitation of unpatched software and misconfigured IT systems, specifically targeting automated disbursement APIs in financial firms. The eMudhra incident was directly linked to a "Python scripting error" that created weak security keys. While not directly exploited in new incidents this week, two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were flagged in October 2026 as critical weaknesses in India's digital infrastructure, capable of allowing unauthenticated attackers to execute arbitrary code.

In response to these threats, the Indian government's cyber policy and response included CERT-In and the Indian Cybercrime Coordination Center (I4C) issuing advisories to financial institutions. These advisories urged urgent implementation of prescribed measures, reporting cyber incidents to CERT-In within six hours, and aligning security controls with CERT-In's May 2026 blueprint for defending against AI-assisted vulnerability exploitation. Furthermore, the DRDO released IRSA Security APIs on November 10, 2026, to enhance security integration for India's indigenous software-defined radio ecosystem.

Background: Threat actors known to target India include APT29 (Russia-linked), Lazarus Group (North Korea-linked), MuddyWater (Iran-linked), Turla (Russia-linked), WIZARD SPIDER (Russia-linked), APT27 (China-linked), APT10 (China-linked), and APT15 (China-linked).

Geopolitical Impact and Regional Dynamics

India's recent security and diplomatic developments have notable implications for regional stability and its relationships with major global powers. The ongoing AI-driven cyberattacks by China-linked 'Crafty Falcon' against India's financial sector underscore persistent cyber espionage and potential economic destabilization efforts from Beijing, adding another layer of complexity to the already strained India-China relationship. This cyber aggression contrasts with India's efforts to strengthen its indigenous defense capabilities, such as the acquisition of next-generation corvettes and minefield breaching systems, which bolster its strategic autonomy and regional deterrent posture.

Relations with the United States saw continued engagement on a proposed Bilateral Trade Agreement (BTA), with talks held in New Delhi on November 2-3, 2026. The recent US midterm elections, which resulted in Democratic control of both chambers of Congress, are perceived by some analysts as potentially creating a more predictable environment for India-US trade relations, possibly accelerating the stalled BTA negotiations by curbing President Trump's protectionist tendencies. However, sticking points remain, including tariffs, market access for agri-dairy products, and US concerns over India's continued purchase of Russian oil, which could impact the pace of full agreement.

India's diplomatic and economic diversification efforts, particularly with Europe and Russia, continue to be a strategic hedge. While India's oil purchases from Russia remain a point of contention with the US, its deepening ties with the European Union, as evidenced by the progress on the FTA and digital cooperation, demonstrate a commitment to expanding its strategic partnerships beyond traditional alignments. The PapRAT cyber-espionage campaign by the South Asian group Bitter, targeting organizations across the region, highlights the pervasive and evolving nature of regional cyber threats, which could destabilize critical infrastructure and sensitive government operations across South Asia. India's increasing focus on space-based military capabilities, as discussed in the seminar on "Leveraging Space for Land Forces," signifies a strategic shift towards multi-domain operations, enhancing its influence and security projection in the broader Indo-Pacific region. The emphasis on the Strait of Malacca as a critical lifeline further underscores India's strategic maritime interests and its role in ensuring regional trade and energy security.

EU Relations and Implications

India's relations with the European Union saw significant positive momentum during this period, particularly in trade, investment, and digital cooperation. India and the EU agreed to deepen cooperation in trade, investment, and critical technologies, anticipating the proposed signing of their Free Trade Agreement (FTA) next month. The 7th India-EU Strategic Partnership Review Meeting (SPRM), held in New Delhi on November 9, 2026, reviewed progress on the FTA, as well as the proposed Investment Protection Agreement and the Agreement on Geographical Indications. Both Sweden's Ambassador to India, Petra Menander, and Lithuanian Ambassador Diana Mickevičienė emphasized the transformative potential of the FTA to simplify corporate collaboration, facilitate technology transfers, and boost economic ties.

In the digital sphere, the India-EU Digital Cooperation Conference 2026, held in New Delhi on November 2-3, 2026, served as a crucial platform to explore collaboration in emerging digital technologies, including AI, semiconductors, 6G, high-performance computing, and digital infrastructure. Discussions at the SPRM further covered cooperation in AI, quantum technologies, digital public infrastructure, advanced semiconductors, clean technologies, and biotechnology. A significant development was the welcoming of India's potential association with Horizon Europe, the EU's substantial research and innovation program, indicating a deepening of research collaboration. These engagements align with the objectives of the EU-India Trade and Technology Council (TTC), which serves as a platform for cooperation on critical technologies.

The security and cyber developments in India have direct implications for EU interests and EU-funded cooperation. The pervasive cyber threats, including AI-driven attacks by China-linked groups and the PapRAT cyber-espionage campaign, pose risks to EU companies operating in India and to the integrity of joint digital and research cooperation projects. EU-funded cooperation projects in sectors like Infrastructure & Transport, Development Cooperation, Trade & Investment, Peace & Security, and Research & Innovation could be vulnerable to these sophisticated cyber threats. Therefore, robust cybersecurity frameworks and shared threat intelligence will be crucial to safeguard these collaborations and ensure the secure development and deployment of digital technologies between India and the EU.

Military and Defense Analysis

India's military and defense posture during this period demonstrated a clear trajectory towards modernization, indigenous capability development, and strategic adaptation to evolving warfare domains. The Indian Army is significantly intensifying its focus on the space domain as a critical enabler for battlefield success. This was highlighted by a seminar on "Emerging Battlefield: Leveraging Space for Land Forces" held on November 3, 2026, in New Delhi. Discussions centered on enhancing Space Domain Awareness, developing Space Denial capabilities, and ensuring secure satellite communications, underscoring a strategic shift towards integrating space-based assets into multi-domain operations. This focus aligns with India's broader emphasis on building resilient indigenous space technologies and reducing dependence on external systems.

In terms of defense acquisitions and capability developments, the Ministry of Defence signed substantial contracts. On November 2, 2026, orders worth approximately $5.7 billion were placed for eight Next Generation Corvettes (Project 28A), marking India's first fully in-house warship design. This acquisition will significantly enhance the Indian Navy's capabilities. Additionally, on November 9, 2026, contracts worth ₹975 crore were signed for TRAWL Assemblies for T-72 and T-90 tanks, designed to boost the Indian Army's minefield breaching capabilities. These systems, developed by DRDO, fall under the 'Buy (Indian–Indigenously Designed, Developed and Manufactured)' category, reinforcing the government's 'Aatmanirbhar Bharat' (self-reliant India) vision. Further strengthening indigenous capabilities, the Indian Space Research Organisation (ISRO) successfully completed the flight acceptance test of the cryogenic engine for its upcoming GSLV-F19 mission (NVS-04 navigation satellite) on November 5, 2026.

The Agnipath scheme saw a significant policy adjustment on November 4, 2026, with the Union Cabinet approving a two-year extension of service for Agniveers. This decision creates a pathway for all Agniveers to continue serving in the armed forces beyond their initial four-year tenure, with opportunities for permanent absorption. This move is aimed at preparing India's military for the changing character of warfare by ensuring a more experienced and integrated force. Complementing these efforts, the DRDO released the IRSA Security APIs on November 10, 2026, completing India's military radio standard. This development is crucial for enabling standardized security integration across the indigenous software-defined radio (SDR) ecosystem, enhancing secure communications and interoperability within the armed forces.

Outlook and Forecast

Short-term trends (1-3 months): India is expected to continue facing a high and evolving cyber threat, particularly from state-sponsored actors and financially motivated groups. The prevalence of AI-driven attacks, as warned by CERT-In, suggests that the speed and sophistication of cyber intrusions will only increase, with the financial sector remaining a prime target. The PapRAT cyber-espionage campaign by Bitter is likely to persist across South Asia, requiring sustained vigilance. Diplomatically, the signing of the India-EU Free Trade Agreement is anticipated in the coming month, which will significantly deepen economic and technological cooperation. India-US trade negotiations for the Bilateral Trade Agreement are also expected to continue, potentially gaining momentum following the US midterm election results. On the defense front, India will likely maintain its focus on indigenous defense production and space-based capabilities, with further announcements on modernization programs and strategic partnerships.

Critical flashpoints and risk areas: The most critical flashpoint remains cybersecurity vulnerabilities, especially within India's extensive digital infrastructure and financial systems. The rapid adoption of AI by threat actors means that traditional defenses may be outpaced, leading to faster and more impactful data breaches and financial fraud. Supply chain vulnerabilities, as highlighted by the eMudhra incident, pose systemic risks that could have cascading effects across critical sectors. Geopolitically, while not explicitly highlighted in this week's news, border tensions with China and Pakistan remain underlying risk areas that could escalate rapidly. The ongoing balancing act in relations with major powers (US, China, Russia, EU) will require astute diplomacy to navigate differing interests, particularly concerning trade and energy security.

Indicators to monitor: Key indicators to monitor include the frequency and impact of AI-driven cyberattacks on Indian organizations, particularly in the financial and critical infrastructure sectors. Progress and finalization of the India-EU FTA and India-US BTA will be crucial for assessing India's economic and strategic alignment. Developments in India's indigenous defense projects, especially in space capabilities and advanced military hardware, will indicate the pace of its self-reliance goals. Any new military exercises or border incidents with neighboring countries should be closely watched for potential escalations. Furthermore, the effectiveness of government cyber policies and the implementation of security recommendations by financial institutions will be vital in mitigating cyber risks.

Strategic recommendations: To address the elevated cyber threat, India must prioritize strengthening cybersecurity defenses across all critical infrastructure and financial institutions. This includes investing in advanced AI-driven threat detection and response capabilities, enhancing threat intelligence sharing mechanisms, and conducting regular, realistic red-team exercises to simulate machine-speed attacks. A proactive approach to identifying and patching vulnerabilities, particularly in widely used software and APIs, is essential. Diplomatically, India should continue to diversify its strategic partnerships, leveraging engagements with the EU for technological and economic benefits while carefully managing complex relations with the US, China, and Russia. Accelerating indigenous defense modernization and self-reliance initiatives will enhance India's strategic autonomy and deterrent capabilities in a volatile geopolitical environment. Finally, fostering a culture of cybersecurity awareness and resilience across both public and private sectors is paramount.

Sources

• newsonair.gov.in
• indiandefensenews.in
• indianexpress.com
• webindia123.com
• newindianexpress.com
• hindustantimes.com
• abplive.com
• dailypioneer.com
• indiandefensenews.in
• envantermedya.com
• ddnews.gov.in
• livemint.com
• arabnews.pk
• ground.news
• youtube.com
• infosecurity-magazine.com
• darkreading.com
• daily.dev
• aviatrix.ai
• thehackernews.com
• the420.in
• indiatimes.com
• beinsure.com
• teiss.co.uk
• checkpoint.com
• indiatoday.in
• gujaratsamachar.com
• knnindia.co.in
• ddindia.co.in
• newindianexpress.com
• hindustantimes.com
• awazthevoice.in
• indiandefensenews.in
• europa.eu
• inpacehub.eu
• inpacehub.eu