India recorded 265.52 million cyber threat detections between October 2024 and September 2025, according to the India Cyber Threat Report 2026 released by Seqrite, the enterprise security division of Quick Heal Technologies Limited. The findings indicate a sharp rise in AI-enabled and automation-driven attacks, with engineering and manufacturing emerging as one of the most targeted sectors.
Seqrite documented the detections across more than 8 million endpoints nationwide, averaging 505 detections per minute. The engineering and manufacturing sector alone accounted for 3.79 million detections, representing 14.22 percent of total industry volume. The sector ranked among the top three most affected industries, alongside education and healthcare, which together contributed nearly 47 percent of overall detections.
Threat activity closely tracked India’s industrial concentration. Maharashtra reported the highest volume at 36.13 million detections, followed by Gujarat with 24.13 million and Karnataka with 11.64 million. Tamil Nadu recorded 7.51 million detections. Key industrial hubs such as Mumbai, Pune, Bengaluru, and Chennai were among the most targeted urban centers, reflecting the vulnerability of concentrated manufacturing and export ecosystems.
The report notes a shift from opportunistic malware to structured, automation-led intrusion campaigns. Trojans accounted for approximately 88.4 million detections, while file infectors contributed around 71.1 million—together forming nearly 70 percent of total malware activity. Common entry vectors included phishing attachments, compromised utilities, exposed SMB services, and infected industrial design systems. Although ransomware represented less than one percent of total detections, its operational impact was significant. In January 2025 alone, ransomware incidents peaked at 185 cases with over 113,000 detections, driven by campaigns such as Xelera and Weaxor.
Network-level vulnerabilities further expanded the attack surface. More than 9.2 million exploit scans targeted internet-facing applications, including WordPress plugins and Apache Tomcat servers. Over 8 million LNK-based exploit detections were recorded at the host level, highlighting continued propagation across shared industrial networks. Notably, 91 percent of detections originated from on-premise environments, underscoring the exposure associated with legacy infrastructure and hybrid IT-OT systems.
Beyond operational disruption, breaches in manufacturing environments pose risks to intellectual property, supplier data, and regulatory compliance. The report emphasizes that as factories adopt digital platforms and connected technologies, cybersecurity must extend beyond perimeter defenses to protect production continuity and supply-chain resilience.
