India faces heightened risk of cyberattacks on critical infrastructure in 2026, warns Kaspersky research
India is likely to see an increase in cyberattacks targeting critical infrastructure and government systems in 2026, driven by geopolitical tensions, cross-border conflicts and the continued digitisation of operational technology (OT) environments, according to researchers from Kaspersky.
Experts from Kaspersky’s Global Research & Analysis Team (GReAT) indicate that advanced persistent threats (APTs) affecting India will increasingly be shaped by regional geopolitics and ideological motivations. These threats are expected to go beyond traditional cyberespionage, with a growing focus on disruption-orientated attacks.
Saurabh Sharma, Lead Security Researcher for GReAT at Kaspersky, said that state-sponsored actors and non-state groups are likely to continue leveraging cyber operations as an extension of geopolitical conflict. He noted that defacement campaigns, data leaks, ransomware incidents with political messaging, distributed denial-of-service (DDoS) attacks and cyber activity linked to diplomatic flashpoints could become more frequent.
Expanding digital footprint increases exposure.
India’s push towards digital public infrastructure, including large-scale digitisation of government services and smart city initiatives, has expanded the national attack surface. According to Kaspersky’s analysis, sectors such as power, utilities, transportation, smart cities and public administration are becoming increasingly interconnected, sometimes relying on legacy security frameworks that were not designed for modern threat scenarios.
While digitisation has improved efficiency and service delivery, it has also increased exposure to targeted attacks aimed at disruption rather than data theft alone. Researchers warn that future campaigns could involve interference with electricity and water supplies, transport systems, supply chains or other essential services.
As IT and OT systems continue to converge, Saurabh emphasised that advanced threat intelligence and integrated security operations centres (SOCs) will play a critical role in maintaining operational continuity and protecting national interests.
Threat outlook for enterprises and government
Kaspersky’s researchers highlight that many APT groups continue to rely on spear-phishing as an initial access vector, underscoring the importance of organisational readiness alongside technical controls. They also note that intelligence-led security approaches will become increasingly important as attackers adopt more sophisticated and persistent tactics.
The company has published a detailed assessment of India’s enterprise threat landscape, including analysis of APT activity, espionage campaigns and emerging attack techniques, as part of its latest threat reporting.