India among top 5 APAC countries targeted by advanced cyber threats: Report

Kaspersky data shows 75 million cyberattacks blocked across APAC in the first half of 2026, including 3.4 million backdoor attacks, 2.4 million password stealers and 250,000 ransomware incident

India is among the five APAC countries most targeted by advanced persistent threats (APTs), according to Kaspersky’s Global Research and Analysis Team (GReAT), highlighting the region’s exposure to sophisticated and targeted cyber campaigns. The company monitors more than 900 APT groups globally, with five of the 12 countries most targeted by these groups located in APAC: China, India, Myanmar, Pakistan and Vietnam.

 

The finding comes as Kaspersky blocked 75 million attacks from online resources across APAC in the first half of 2026. Between January and June, the company blocked 3.4 million backdoor attacks, 2.4 million password-stealer attacks and 250,000 ransomware incidents.

 

 

AI is making cyberattacks faster and more adaptive

 

According to Kaspersky GReAT, threat actors are increasingly leveraging AI across different stages of their operations. The company specifically points to the use of AI to automate reconnaissance, speed up malware development and scale attacks.

 

This means attackers can use technology to make parts of their operations faster and more adaptable. Kaspersky's report noted that the trend is important even as some individual attack categories showed slight declines during the first half of the year.

 

The development comes as advanced cyber threats remain a major part of the global threat landscape. Kaspersky said the three largest categories of high-severity security incidents globally in 2025 were advanced persistent threats (APTs), which accounted for 24 per cent, followed by social engineering at 15 per cent and malware at 12 per cent. 

 

For context, an APT is a highly sophisticated, targeted cyber campaign in which attackers gain unauthorised access to a network and maintain a covert presence over an extended period. Such operations can be used for cyber espionage, stealing sensitive information or achieving longer-term strategic objectives. 

 

India among top APT targets

 

APAC is also a major region for advanced persistent threat activity. Kaspersky GReAT monitors more than 900 APT groups worldwide and five of the 12 countries most targeted by APTs globally are located in APAC. The countries include China, India, Myanmar, Pakistan and Vietnam.

 

In the report, Sergey Lozhkin, Head of APAC and META research units at Kaspersky GReAT, said, “APAC as a global leader in digital transformation and even in AI agent adoption, coupled with its complex geopolitical environment, makes it a high-value target for threat actors behind the most advanced persistent threats.”

 

The company said the concentration of targeted countries in the region highlights the importance of continuous threat intelligence, resilient cyber defences and stronger regional cooperation.

 

Supply-chain attacks put trusted software at risk

 

Kaspersky also warned of growing risks from software supply-chain attacks. A recent Kaspersky study found that nearly one in three organisations globally experienced a supply-chain-related incident over the past year. China was among the countries with the highest exposure, with 40 per cent of businesses reporting supply-chain risks.

 

The company highlighted several incidents to show how attackers are exploiting trusted software and update mechanisms.

 

In one case, attackers compromised the update infrastructure of eScan, an antivirus and endpoint security product developed by a Mumbai-based Indian cybersecurity company. The attackers used the trusted update server to distribute malware to customers, effectively turning legitimate security software into an infection vector.

 

Another incident involved Notepad++, a free, open-source text and source-code editor widely used by developers, system administrators and IT professionals. Kaspersky said a malicious installer delivered a Trojan backdoor that allowed attackers to maintain access to affected systems for months.

 

The company also identified an active supply-chain attack targeting the official website of Daemon Tools that had been underway since April 2026. Attackers bundled malware with legitimate software, allowing them to remotely compromise infected devices. The campaign had affected more than 2,000 victims across more than 100 countries and territories.

 

Axios attack highlights open-source software risk

 

Another major supply-chain incident highlighted by Kaspersky involved Axios, a widely used JavaScript HTTP client library with more than 100 million weekly downloads on npm. In March 2026, attackers compromised the npm account of a lead Axios maintainer and used the account to publish malicious versions of the package.

 

During its analysis of the Axios supply-chain attack, Kaspersky GReAT identified technical overlaps with two BlueNoroff campaigns previously documented by the company — GhostCall and GhostHire.

 

BlueNoroff is described by Kaspersky as a financially motivated subgroup of the Lazarus Group that targets financial institutions and cryptocurrency platforms. GhostCall and GhostHire targeted high-value individuals in the crypto industry, with GhostCall using social engineering against executives and GhostHire disguising malware as job opportunities and coding tests aimed at blockchain developers.

 

Malicious open-source packages rise 37 per cent

 

Kaspersky said the volume of threats targeting open-source software is also rising.

The company detected 19,484 malicious packages in 2025, compared with 14,197 in 2024, marking a 37 per cent increase. Hacktool detections also rose 11 per cent year-on-year, from 2,966 to 3,302.

 

The report noted that the findings underline the need for organisations to strengthen software supply-chain security as open-source components become increasingly important to modern applications.

 

The company is also focusing on the open-source software ecosystem through its Open-Source Software Threats Data Feed, which provides information on vulnerabilities, malicious and compromised packages, riskware and hacking tools.

 

Threat landscape extends beyond direct attacks

 

The findings show that the cyber threat facing organisations in APAC extends beyond direct attacks such as ransomware, password theft and backdoors. While the report stated that Kaspersky blocked 75 million attacks from online resources in the first half of 2026, the company is also tracking the increasing use of AI by threat actors and the growing targeting of software supply chains.

 

For organisations, the risks can therefore emerge through the software and services they rely on, rather than only through direct attempts to breach their own systems. The eScan, Notepad++, Daemon Tools and Axios incidents highlighted by Kaspersky show different ways attackers can exploit trusted software and infrastructure to reach users.

 

According to Kaspersky, the combination of a highly active regional threat landscape, advanced persistent threats, AI-assisted attacks and growing supply-chain risks makes continuous threat intelligence and stronger cyber defences important for organisations across APAC.