India Threat Tracker

A curated, machine-readable feed of what's actually hitting Indian orgs and users: actively-exploited CVEs, fake-APK campaigns, and India-focused APT activity. Defensive use only — indicators, never samples.

AssessmentOctober 2026· Sohan Kanna · updated 2026-10-20

The Indian threat picture this month is pulled in two directions at once: high-volume, financially-motivated mobile fraud hitting citizens at scale, and patient, state-aligned intrusion aimed at government, defence and critical infrastructure. The common seam is the edge — VPNs, firewalls and cloud identity — which is where ransomware crews and espionage actors alike still get their first foothold.

  1. 1

    Fake-APK UPI fraud has gone industrial

    criticalpayments fraud

    This is no longer lone scammers. Organised mule networks are running fake RTO / e-challan APKs end to end — a single Mumbai bust traced roughly ₹43 crore, with parallel networks in Pune and Ahmedabad. The money moves through first-time payees and mule fan-out faster than most risk controls react, and the malware (GhostBat RAT and kin) reads the OTP and captures the UPI PIN on-device. For any payments operator, this is the live, high-volume threat — not a future one.

    The UPI fraud kill chain →GhostBat RAT breakdown →
  2. 2

    The edge is still the way in

    highexploited vulns

    The India-relevant watchlist is dominated by internet-facing edge: Ivanti Connect Secure, Citrix NetScaler, PAN-OS, Fortinet, plus SharePoint (CVE-2025-53770, EPSS ~100%, ransomware-linked). These are precisely the products Indian enterprises expose to the internet and precisely the ones ransomware crews mass-exploit within days of a PoC. If you do one thing this month, make it edge patch cadence — it is the single highest-leverage control on this list.

    PAN-OS management-interface zero-day →Live watchlist →
  3. 3

    Pakistan-nexus espionage is persistent, not episodic

    highapt

    Transparent Tribe (APT36) and SideCopy continue to target Indian government, defence, education and research with Crimson RAT and the ZIP→LNK→LOLBin delivery pattern. These are not one-off campaigns; they are a standing collection effort that re-tools faster than it disappears. If you sit in gov, defence or academia, assume you are in scope and detect for the delivery chain, not just the final implant.

    Transparent Tribe (APT36) →SideCopy →
  4. 4

    Identity is the new perimeter — watch M365 sign-ins

    medium-highapt

    FrostArmada (APT28) demonstrated adversary-in-the-middle token theft fronting Outlook on the web via SOHO-router DNS hijack. As Indian orgs move onto M365 / Entra, a high-risk sign-in that survives MFA is worth more to an attacker than any single endpoint. The signals to wire up now are Entra sign-in risk and unexpected endpoint DNS changes — together they catch this chain.

    FrostArmada / APT28 M365 interception →
  5. 5

    China-nexus pre-positioning in the power sector

    mediumapt

    RedEcho's targeting of load dispatch centres is about access held for later, not immediate disruption — lower tempo, higher stakes. This is the kind of intrusion that matters in a crisis rather than a quarterly report, and it belongs on the radar of anyone defending Indian critical infrastructure even when nothing is visibly happening.

    RedEcho and the China-nexus grid targeting →

Analyst judgement over the feeds below — dated and opinionated by design. How this is scored →

Open datagithub.com/sohankanna/india-threat-tracker →How this is scored →

Everything here is JSON you can pull into your own tooling. Example:

curl -s https://raw.githubusercontent.com/sohankanna/india-threat-tracker/main/data/exploited-cve.json \
  | jq '.items[] | select(.india_relevance=="high" and .watchlist==true)
        | {cve, vendor, product, epss, due_date}'

Actively exploited · watchlist

updated 2026-10-19

Three signals, and they mean different things. Read them together, not in isolation.

CISA KEV

Known to be exploited in the wild. This is fact, not prediction — if it's here, attackers are using it.

EPSS

A probability of exploitation in the next 30 days (FIRST). A forecast, 0–100%.

India relevance

My heuristic for tech with a heavy India footprint — a starting filter, not proof of exposure at your org.

EPSS ≥
sort

244 matches · showing first 60

Where the APK fraud surfaces

Operator hubs and reported cases from India's 2026 fake-APK busts.

Delhi — Operator network (Mumbai bust)Himachal Pradesh — Public challan-scam advisoriesJharkhand — Operator hub — APK developers/sellers traced here (Ahmedabad & Mumbai busts)Karnataka — Udupi: high-value APK-link lossBihar — Mule & operator network (Mumbai bust)Gujarat — Ahmedabad: Telegram-storefront network dismantledMaharashtra — Mumbai ₹43cr / 3,206 cases; Pune ₹14L+
operator hubcases reported
Operator hubs
  • Jharkhand — APK developers/sellers traced here (Ahmedabad & Mumbai busts)
  • Bihar — Mule & operator network (Mumbai bust)
  • Delhi — Operator network (Mumbai bust)
Cases reported
  • Gujarat — Ahmedabad: Telegram-storefront network dismantled
  • Maharashtra — Mumbai ₹43cr / 3,206 cases; Pune ₹14L+
  • Karnataka — Udupi: high-value APK-link loss
  • Himachal Pradesh — Public challan-scam advisories

Geography from public police busts and news reports, not live telemetry — the lures themselves reach phones nationwide. It shows where the ecosystem has surfaced, not the full spread.

Fake-APK & smishing campaigns

The RTO-challan, bank-KYC and utility-bill lures draining accounts across India.

activehighread the breakdown →

GhostBat RAT - RTO/mParivahan-themed Android campaign

Multi-stage Android malware impersonating the mParivahan RTO app, spread via WhatsApp and SMS smishing with shortened URLs. Droppers use ZIP manipulation and native packers; a fake UPI payment flow harvests the UPI PIN, and banking SMS is exfiltrated. Some variants also bundle a cryptominer. 40+ distinct samples observed.

#rto-challan#mparivahan#vehicle-fineimpersonates: mParivahan / RTO
telegram_bots: GhostBatRat_bot
hosting: raw.githubusercontent.comgithub.com (releases)
c2_type: firebase-fcmtelegram-bot-api
source: Cyble - GhostBat RAT: inside the resurgence of RTO-themed Android malware
confidence: high· first seen 2025-09· verified 2026-10-20
activehighread the breakdown →

RTO Challan fraud - two-stage dropper (jsonserv C2)

e-Challan / RTO-themed two-stage dropper. A fake 'update' prompt installs a second APK that hides its icon (INFO category), collects Aadhaar/PAN and full card/UPI details via fake payment screens, and intercepts incoming SMS for OTP harvesting. C2 over HTTP POST to jsonserv domains.

#rto-challan#e-challan#traffic-fineimpersonates: RTO / e-Challan
domains: jsonserv[.]xyzjsonserv[.]biz
sha256: 9209fc088cdcd7da0161cabf5b9384c2ca790214413ffb437452bcc865c5845222cf70a0dd866a4f5addd5d339fad3894a4ebb3e97d597fd7dac9b08899052fb
source: CYFIRMA - RTO Challan Fraud: a technical report on APK-based financial and identity theft
confidence: high· first seen 2025-10· verified 2026-10-20
law-enforcementhighread the breakdown →

Ahmedabad APK fraud network (Telegram storefront)

Ahmedabad Cyber Crime Branch dismantled a network running a Telegram bot that sold, swapped and renewed fraud APKs impersonating SBI KYC/rewards, other banks, RTO services and utilities. One distributor allegedly supplied ~400 fraudsters; linked losses ~Rs 54 lakh. Cash-out via ATM withdrawals left no direct bank trail. No technical IOCs published.

#sbi-kyc#bank-rewards#rto-challan#electricity-bill#gas-billimpersonates: SBIimpersonates: RTOimpersonates: electricity/gas utilities
source: ETV Bharat - Gujarat Police bust pan-India APK fraud racket
confidence: medium· first seen 2026-06· verified 2026-10-20
activehighread the breakdown →

Pune fake RTO e-challan APK scam

Two Pune residents lost a combined Rs 14+ lakh after installing APK files attached to fake RTO e-challan notices. Pune police advised checking challans only on official government platforms and never installing APKs from SMS/WhatsApp links.

#rto-challan#e-challanimpersonates: RTO / e-Challan
source: The Bridge Chronicle - Two Punekars lost over Rs 14 lakh in fake RTO e-challan APK scam
confidence: medium· first seen 2026-06· verified 2026-10-20
law-enforcementhighread the breakdown →

Mumbai interstate APK fraud network (~Rs 43 crore, 3,206 cases)

Mumbai Cyber Police arrested six members of an interstate syndicate linked to 3,206 complaints on the national portal (~Rs 43 crore). APKs impersonated banks, Mahanagar Gas (MGL) and the RTO; a typical lure warned of a gas disconnection and asked the victim to install an app and pay Rs 10. The apps intercepted OTPs and banking SMS. Forensics found 111 distinct fake APKs; ~8,609 people installed them, and ~1.24 crore SMS were exfiltrated via servers on Google Firebase and Hostinger.

#gas-bill#bank-update#rto-challanimpersonates: Mahanagar Gas (MGL)impersonates: banksimpersonates: RTO
c2_type: firebasehostinger-hosted
source: Free Press Journal - 6 arrested as Mumbai cyber police bust Rs 43 crore fake APK fraud network (26 Jun 2026)
confidence: medium· first seen 2026-06· verified 2026-10-20
activehighread the breakdown →

APK lure themes in rotation (2026)

Reference entry for the social-engineering lures driving APK fraud in India. The same malware is repackaged behind whatever pretext is topical: RTO/traffic e-challan, bank KYC and reward points (SBI and others), gas and electricity bill updates (e.g. Mahanagar Gas), PM-Kisan and PM-Awas Yojana benefit checks, credit-card offers, 'digital arrest' intimidation, and WhatsApp wedding-invite APKs. All lead to an installed APK that reads SMS/OTPs and drains accounts. Police advice is consistent: never install an app from an SMS/WhatsApp link; use only official channels.

#rto-challan#bank-kyc#bank-rewards#gas-bill#electricity-bill#pm-kisan#pm-awas-yojana#credit-card#digital-arrest#wedding-inviteimpersonates: RTOimpersonates: SBI and other banksimpersonates: gas/electricity utilitiesimpersonates: government benefit schemesimpersonates: police
source: Moneylife - From e-challan and gas-bill updates to APK traps
confidence: high· first seen 2026· verified 2026-10-20
historicalhighread the breakdown →

Android banking trojan - MITM + anti-analysis (case study)

Hands-on analysis of a sophisticated Android banking trojan spread from a compromised WhatsApp group, using a man-in-the-middle VPN technique and advanced anti-analysis to steal banking credentials. Representative of the higher end of the Android threat targeting Indian users.

#whatsapp-groupimpersonates: banking app
source: sohankanna.com - Deconstructing a Stealthy Android Trojan
confidence: high· first seen 2025-10· verified 2026-10-20

Indicators (7)

defanged · defensive use only
iocs.txt →
## domains
jsonserv[.]xyz
jsonserv[.]biz

## sha256
9209fc088cdcd7da0161cabf5b9384c2ca790214413ffb437452bcc865c58452
22cf70a0dd866a4f5addd5d339fad3894a4ebb3e97d597fd7dac9b08899052fb

## telegram_bots
GhostBatRat_bot

## hosting
raw.githubusercontent.com
github.com (releases)

India-focused APT activity

State-nexus actors whose primary targets are in and around India.

Transparent Tribe

(APT36, Mythic Leopard, ProjectM, C-Major)Pakistan-nexus

A long-running espionage actor that primarily targets Indian government, defence and education sectors. Typical tradecraft is spear-phishing with weaponised documents and LNK files, and fake or trojanised apps, delivering RATs such as Crimson RAT, CapraRAT (Android) and Poseidon. 2026 reporting describes new RAT activity, LNK-based delivery chains, and expansion toward India's startup ecosystem.

Crimson RATCapraRATPoseidonElizaRAT
read the profile →
confidence: high· verified 2026-10-20

SideCopy

(APT-C-?, SideCopy (linked to Transparent Tribe))Pakistan-nexus

A Pakistan-nexus espionage actor that mimics the SideWinder group's TTPs (hence the name) and is widely assessed to overlap with Transparent Tribe/APT36 infrastructure. It targets Indian government, defence and increasingly academic and research institutions. Typical delivery is a ZIP archive embedding an LNK or decoy document that leads to RATs such as ActionRAT, AllaKore and AuTo Stealer, hosted on compromised domains.

ActionRATAllaKore RATAuTo StealerReverseRAT
read the profile →
confidence: high· verified 2026-10-20

RedEcho / TAG-38 (China-nexus)

(RedEcho, TAG-38)China-nexus

China-nexus intrusion sets that have repeatedly targeted India's power sector and critical infrastructure. Recorded Future documented RedEcho targeting Indian electricity load-dispatch centres, and later TAG-38 activity against grid infrastructure in Ladakh using the ShadowPad backdoor and compromised internet-facing DVR/IoT devices for C2. A reminder that the threat to India isn't only fraud and Pakistan-nexus espionage.

ShadowPadPlugX
read the profile →
confidence: medium· verified 2026-10-20

SideWinder (India-nexus)

(SideWinder, Rattlesnake, APT-C-17)India-nexus (attributed)

Regional context: one of South Asia's most active APTs, assessed as India-nexus, historically targeting Pakistan, Nepal, China and Afghanistan and more recently expanding to maritime, nuclear and IT sectors across Asia, the Middle East and Africa. Primarily spear-phishing with weaponised documents exploiting known Office flaws. Included here for regional awareness; its targets are largely outside India.

WarHawkBackdoor loadersStealerBot
MITRE ATT&CK profile →
confidence: high· verified 2026-10-20

Global context: state-nexus actors

India sits inside a wider threat landscape. Here's who the major state-nexus clusters are and what they're known for.

Russia — Intelligence collection and destructive operationsNorth Korea — Financial theft (crypto, supply chain) and espionageIndia — primary focusPakistan — Regional espionage aimed squarely at IndiaIran — Espionage and disruptive/wiper operationsChina — Espionage, IP theft, and pre-positioning in critical infrastructure
threat originIndia (focus)

China

Espionage, IP theft, and pre-positioning in critical infrastructure

Russia

Intelligence collection and destructive operations

North Korea

Financial theft (crypto, supply chain) and espionage

Iran

Espionage and disruptive/wiper operations

  • OilRig (APT34), Charming Kitten (APT35), MuddyWater

Pakistan

Regional espionage aimed squarely at India

Attribution is an assessment, not a certainty, and groups don't map cleanly to governments. This is context for who operates and who they target — not a live attack map. Linked items are covered in depth on this site.

Detection pack

Open, tunable detections for the threats tracked here — Sigma rules for the CVEs, APT TTPs and malware, plus payments-fraud logic for the UPI kill chain. Each Sigma rule ships pre-converted for Splunk, Elastic and Wazuh, with a data-sources & validation guide covering the telemetry each one needs to fire. Browse the pack →

Sigma+ Splunk · Elastic · Wazuh
  • PAN-OS mgmt auth from an unexpected source (CVE-2026-0322)
  • Entra ID high-risk sign-in / AiTM token replay (FrostArmada)
  • Endpoint DNS pointed at an untrusted resolver (FrostArmada)
  • ZIP→LNK→LOLBin delivery (SideCopy / APT36)
  • Malicious-macro execution (Crimson RAT / APT36)
Fraud signalsrisk-engine logic
  • OTP read then transfer within seconds
  • New-device UPI binding + high-value activity
  • Recent SIM swap before binding / transfer
  • First-time payee drained at machine speed
  • Mule fan-out pattern on a beneficiary
the kill chain they map to →

Data: CC-BY-4.0. Actively-exploited feed from CISA KEV + FIRST EPSS. Campaign and APT entries are curated from public reporting.