Ransomware-as-a-Service in 2025: How Indian Enterprises Can Break the Kill Chain

• 20 October, 2026
• No Comments

Ransomware-as-a-Service (RaaS) has transformed cybercrime from a specialist endeavour into a franchise model available to nearly anyone willing to pay a cut of the ransom. In 2025, Indian enterprises—particularly mid-market manufacturers, logistics providers, healthcare networks, and financial-services firms—find themselves squarely in the crosshairs of RaaS operators who have learned that a company without 24/7 detection capability is far easier to compromise than a well-defended one in Western markets. This post examines how RaaS operates today, where the kill chain typically breaks down, and what a structured defence looks like for organisations operating in India’s regulatory environment.

What Ransomware-as-a-Service Actually Looks Like in 2025

Modern RaaS is a supply chain. Core developers maintain the ransomware binary, the decryption portal, and the negotiation infrastructure—and rent it to “affiliates” who handle the actual intrusion. The affiliate typically purchases an initial access broker (IAB) credential, pivots through the network over days or weeks, exfiltrates sensitive data, and only then deploys encryption. If the victim refuses to pay, data is published on a leak site.

The economics are stark: RaaS operators advertise profit splits as high as 70–80 percent for affiliates, with the developer taking a royalty on every ransom paid. Negotiation teams operate like professional call centres. Some groups even maintain a “victim services” portal where enterprises can verify which files were stolen before deciding whether to pay.

What has changed most in the last eighteen months is targeting precision. Affiliates now use open-source intelligence, LinkedIn scraping, and dark-web IAB marketplaces to identify organisations whose backups are known to be inadequate, whose IT security budget is limited, or whose business is seasonal—making downtime intolerable. Indian SMEs and mid-market companies increasingly meet all three criteria.

The Kill Chain: Where Intrusions Typically Start

Understanding the typical kill chain is the first step toward breaking it. Modern RaaS intrusions follow a recognisable sequence:

• Initial Access: Phishing email with a macro-enabled Office attachment, exploitation of an unpatched internet-facing vulnerability (VPN appliances, RDP, Exchange), or purchase of stolen VPN credentials from an IAB.
• Execution & Persistence: Living-off-the-land binaries (LOLBins) such as PowerShell, WMI, and certutil. Legitimate remote-access tools are repurposed to blend into normal traffic.
• Privilege Escalation: Kerberoasting, credential dumping, or exploitation of misconfigured Active Directory. Domain administrator rights are the goal.
• Lateral Movement: SMB relay attacks, pass-the-hash, and abuse of legitimate admin shares. Attackers dwell in the network for an average of 14–21 days before deploying encryption.
• Data Exfiltration: Cloud-storage services, SFTP, or Rclone used to quietly push terabytes of data before the encryption payload triggers.
• Impact: Ransomware binary deployed via domain controller, GPO push, or PsExec. Backup catalogues and shadow copies deleted first.

Each of these stages leaves artefacts—event-log entries, anomalous network flows, suspicious process-creation events—but only if someone is watching in real time.

India-Specific Risk Factors

The threat is not hypothetical. Across 2024 and into 2025, a consistent pattern has emerged in incidents affecting Indian manufacturing, pharmaceutical, and logistics firms: under-resourced IT teams, legacy ERP systems with internet-facing admin portals, and a cultural reluctance to report incidents promptly—all exploited systematically by RaaS affiliates who have learned that India’s mid-market offers a favourable risk-to-reward ratio.

CERT-In’s advisories on ransomware trends have noted a measurable uptick in attacks targeting critical-information infrastructure and large enterprises across the subcontinent. The directive requiring 6-hour incident reporting—introduced in 2022 and reinforced through subsequent advisories—means the window from detection to regulator notification is vanishingly small. Organisations without automated detection pipelines routinely miss this window, incurring both reputational and potential regulatory exposure under the DPDP Act 2023 for any personal data affected by the breach.

Breaking the Kill Chain: A Structured Defence

No single control stops a determined affiliate. Defence in depth—layered controls that assume earlier stages will be breached—is the only realistic posture. The following framework maps defensive controls to kill-chain stages.

1. Reduce the Attack Surface

• Enforce multi-factor authentication (MFA) on all internet-facing access—VPN, RDP, webmail, cloud consoles. FortiGate ZTNA policies can enforce per-application MFA even for internal services, replacing broad network-level trust with identity and context-based access.
• Patch VPN appliances, perimeter firewalls, and email servers on a weekly cadence. Unpatched internet-facing appliances remain the single most common initial-access vector seen by incident responders.
• Disable SMBv1 and legacy authentication protocols (NTLMv1, basic LDAP auth) across the domain.
• Audit Active Directory quarterly for stale accounts, service accounts with excessive privileges, and Kerberoastable SPNs. The majority of privilege-escalation paths go through misconfigured AD objects.

2. Harden the Perimeter with Next-Generation Firewall Policies

FortiGate NGFW with IPS, SSL inspection, and application control can identify and block many of the tools affiliates use for lateral movement and exfiltration. Effective FortiGate configurations for ransomware defence include:

• Blocking known cloud-storage exfiltration destinations for managed endpoints—Rclone, anonymous FTP, and certain large file-sharing services.
• Enabling SSL deep inspection on egress traffic: most RaaS command-and-control now operates over HTTPS, and without inspection it is invisible to signature-based detection.
• Subscribing to FortiGate’s botnet and C2 intelligence feed, which provides automated blocking of known ransomware operator infrastructure.
• Geo-restricting inbound connections to countries from which the business has no legitimate traffic.

3. Detect What Gets Through

Perimeter controls will not stop everything. A 24/7 SOC with SIEM and UEBA (User and Entity Behaviour Analytics) capability is the difference between a four-hour containment and a four-day outage. Detection requirements include:

• Centralised collection and correlation of Windows event logs (Security, System, PowerShell Operational), FortiGate traffic and threat logs, DNS query logs, and endpoint telemetry.
• Alerting on bulk file access events suggesting pre-encryption staging or exfiltration, new privileged-account creation outside change-management windows, unusual PowerShell execution patterns, and lateral movement via admin shares.
• MITRE ATT&CK framework mapping to ensure detection rules cover the techniques RaaS affiliates favour most: T1059.001 (PowerShell), T1078 (Valid Accounts), T1486 (Data Encrypted for Impact), and T1041 (Exfiltration over C2 channel).

4. Respond Before Encryption Runs

The most impactful intervention point is the dwell period—the days or weeks between initial access and encryption deployment. CERT-In’s 6-hour reporting window amplifies the need for rapid detection-to-containment workflows. Automated response actions—isolating a compromised endpoint from the network, blocking a suspicious IP on FortiGate, or disabling a compromised Active Directory account—must be executed in minutes, not hours. Manual processes alone cannot reliably achieve this at scale.

5. Back Up Correctly and Test Restoration

Backups remain the last line of defence, but RaaS affiliates specifically target them before deploying encryption. Effective backup posture requires following the 3-2-1-1 rule: three copies, two media types, one offsite, one air-gapped or immutable (using object-lock storage or tape). Critically, restoration must be tested quarterly—many Indian organisations discover only after an incident that their backup jobs were silently failing or that recovery takes far longer than estimated. Backup credentials must be separated from domain administrator credentials.

PrahiX Ora: The SecOps Platform We Deploy and Operate for Clients

Many Indian enterprises tell us the same thing: they have the intent to build a 24/7 security operations capability, but not the integration bandwidth. Stitching together a SIEM, a network management system, a video surveillance platform, and a SOAR tool from four different vendors—and keeping them all current—is a substantial project that competes with every other IT priority. And yet, without this integration, the dwell-period detection that stops ransomware before encryption runs is simply not achievable.

The platform we deploy and operate for clients in these situations is PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner. Rather than stitching disparate tools together, Ora brings four operational pillars under a single pane of glass:

SIEM: Correlated Detection with CERT-In-Aligned Log Retention

Ora ingests event data from firewalls, endpoints, cloud workloads, and enterprise applications, applying correlation rules mapped directly to MITRE ATT&CK. When a sequence of events matches a known lateral-movement or exfiltration pattern, the platform reconstructs the attack storyline as a graph—making it easier for an analyst to understand scope and sequence rather than sifting through thousands of isolated raw events. Tiered retention (hot, cold, archive) is designed to support CERT-In’s direction on 180-day in-country log retention without requiring proportionally large—and expensive—hot storage. This architecture helps evidence compliance with the retention requirements that auditors and regulators increasingly examine.

NMS: Visibility Across Fragmented Multi-Vendor Estates

Many mid-market Indian enterprises operate a mix of FortiGate firewalls, switches from various vendors, multiple brands of access points, and WAN links that may span MPLS and SD-WAN. NOC visibility is fragmented across separate management consoles, creating blind spots during incidents. Ora’s NMS uses LLDP and CDP topology discovery and network path tracing to build a unified topology view, applies ML-based anomaly detection to establish normal traffic baselines, and can push auto-healing policies when significant deviation is detected—reducing mean time to restore for network-layer incidents that might otherwise require manual cross-vendor investigation.

Video Surveillance (VMS): Physical and Network Security Under One Roof

For manufacturing, retail, and multi-site operations, physical security events frequently precede or accompany cyber incidents—insider-threat scenarios in particular. Ora’s video surveillance (VMS) module supports ONVIF, Hikvision, and Dahua camera ecosystems and applies video analytics to flag access anomalies. Crucially, it brings physical security alerts into the same operational view as network and endpoint events. A door-access event at an off-hours time at a remote manufacturing facility can be automatically correlated with an unusual VPN login from the same site—eliminating a manual investigation step that might otherwise take hours.

SOAR: Making CERT-In’s 6-Hour Window Achievable

CERT-In’s 6-hour incident reporting obligation applies to a broad category of incidents, with ransomware attacks explicitly included. Meeting that timeline manually—while simultaneously containing the incident, preserving forensic evidence, and communicating with internal stakeholders—is very difficult without automation. Ora’s SOAR module provides pre-built playbooks with connectors to FortiGate, Active Directory, and ticketing systems, enabling automated response actions such as pushing blocklists to the firewall, disabling compromised accounts, or isolating affected network segments—all triggerable by a SIEM alert. This kind of automation is what makes the 6-hour notification window a realistic operational target rather than an aspirational policy statement.

If your organisation is evaluating a unified SecOps platform, we are happy to walk you through a reference architecture and what a typical deployment looks like in a multi-site Indian enterprise environment. Our intent is always to complement your existing team’s capability, not replace it.

DPDP Act Implications for Ransomware Victims

India’s Digital Personal Data Protection Act 2023 introduces obligations around personal data breaches that are directly relevant to ransomware incidents. Where ransomware involves exfiltration of personal data—employee records, customer PII, payment information—the data fiduciary may face notification obligations to the Data Protection Board and, in certain cases, to affected data principals.

Several points deserve particular attention for Indian enterprise boards and CISOs:

• A RaaS double-extortion attack almost always constitutes a personal data breach if employee or customer data was accessible on compromised systems—even if the attacker never makes use of it.
• The DPDP Act does not mandate an exact breach-notification timeline at the time of writing, but the Board’s draft rules and CERT-In’s 6-hour reporting directive together create a practical expectation of rapid action.
• Incident response documentation—preserved logs, forensic timelines, and evidence of containment actions taken—will be critical for demonstrating due diligence. A SIEM with tamper-evident, retained logs supports this evidentiary requirement and helps evidence compliance with the Act.
• Paying the ransom does not eliminate notification obligations and there is no reliable way to verify that data has been deleted from a threat actor’s infrastructure.

We advise clients to treat DPDP preparedness and ransomware response planning as a single unified exercise: the same logging infrastructure, the same IR playbook, and the same evidence-preservation process serve both obligations simultaneously.

Ransomware Readiness Checklist for Indian Enterprises

Use this checklist to assess your current posture across the kill-chain stages discussed above:

• ☐ MFA enforced on all internet-facing services: VPN, RDP, cloud consoles, webmail
• ☐ Perimeter firewalls and VPN appliances on automated or weekly patch cycle
• ☐ SMBv1 and legacy authentication protocols disabled across the domain
• ☐ Active Directory audit conducted in the last 90 days: stale accounts removed, privileged accounts reviewed
• ☐ 24/7 SIEM with MITRE ATT&CK-mapped detection rules operational
• ☐ Endpoint detection and response (EDR) deployed on all servers and user endpoints
• ☐ Documented IR playbook with CERT-In 6-hour reporting workflow rehearsed
• ☐ Automated response capability (SOAR or scripted) for top ransomware precursor alerts
• ☐ Backup restoration tested against recovery-time objective; immutable or air-gapped copy confirmed
• ☐ DPDP breach-notification workflow documented and assigned to a named owner
• ☐ Ransomware tabletop exercise conducted in the last 12 months

How PJ Networks Can Help

PJ Networks provides 24/7 NOC/SOC services to Indian enterprises across manufacturing, BFSI, healthcare, and logistics. Our managed security portfolio includes FortiGate NGFW deployment and management, ZTNA rollout, FortiMail for email security, and SD-WAN. For clients requiring unified SecOps capability, we deploy and operate the PrahiX Ora platform, handling integration, tuning, and ongoing operations so your internal team can focus on business-aligned security decisions rather than tool maintenance.

If you are reviewing your ransomware readiness following a near-miss, a board request, or an upcoming audit, we offer a structured assessment that maps your current controls against the kill-chain stages above and produces a prioritised remediation roadmap. Reach out to our team at pjnetworks.com/contact to schedule a conversation.