According to new data from Kaspersky, ransomware activity against small and medium businesses (SMBs) intensified globally in Q1 2026, with the company’s threat report recording more than 77,000 users protected from ransomware attacks worldwide during the quarter. Specifically for India, Kaspersky recorded that the share of ransomware detections among SMBs rose from 3.18% in Q1 2025 to 4.07% in Q1 2026.
The increase points to ransomware operators continuing to target Indian SMBs persistently and in growing numbers.
While the percentages look small at a glance, it should be noted that the key in these statistics is less so its modest changes, but rather, the steady continuation in the proportion of SMBs attacked that is telling of its sustained prevalence.
Moreover, the detection metric itself only makes part of the bigger picture. Ransomware actors carry out multi-stage attacks, and only its last stage – the deployment of the encryption Trojan – is reflected as a crypto-ransomware detection. This means that attacks intercepted in its earlier stages, such as during initial access, reconnaissance, discovery, or lateral movement, will not be recorded as part of the statistic here. As a result, the true extent of its prevalence is often understated.
Threat Actors
The rise in detections coincides with the rapid expansion of a newer ransomware-as-a-service group, The Gentlemen, which Kaspersky’s Global Research and Analysis Team (GReAT) has tracked since mid-2025 across industries including manufacturing, IT services, healthcare, financial services, construction and logistics, sectors that form a significant share of India’s SMB base.
As per Kaspersky’s Q1 2026 threat report, Clop (14.42%) returned to the top of the rankings by number of victims listed on data leak sites, displacing Qilin (12.34%), while The Gentlemen (9.25%) has already overtaken established groups such as Akira (7.25%) and INC Ransom (6.13%). According to Kaspersky’s State of Ransomware in 2026 report, Asia-Pacific recorded the second-highest regional share of organizations hit by ransomware in 2025, behind only Latin America.
“Ransomware remains a constant threat, and detection statistics only tell part of the story, they capture the final stage of an attack, the deployment of the encryption Trojan, not earlier stages like initial access or lateral movement that get stopped in time. Attackers also don’t distribute this malware broadly, they target only the victims they consider valuable. SMBs are often attractive targets because many lack dedicated security teams, patch management and backup strategies, and in the event of an incident, may struggle to afford forensics and rapid remediation, which can also make them a stepping stone into larger organizations they work with. Some SMB owners still believe a backup scheme alone is enough, but most modern ransomware actors now use a double extortion approach, encrypting files while also exfiltrating data and threatening to leak it, so a layered cyber protection strategy is essential,” said Fedor Sinitsyn, security expert at Kaspersky.
“India’s SMB sector, which numbers over 6.33 crore enterprises and employs more than 130 million people across manufacturing, IT and other core sectors, is increasingly linked into larger enterprise and global supply chains as it digitizes. As India strengthens its role in global manufacturing and exports, more SMBs find their systems tied to the bigger organizations they supply, which raises their attractiveness as an entry point into those networks. Attackers don’t discriminate by size, the same gaps in credential hygiene, patching and backup discipline open the same doors. At Kaspersky, we believe the biggest defence still isn’t technology alone, it’s basic cyber hygiene paired with the right layered protection ,” said Jaydeep Singh, General Manager for India, Kaspersky.
India’s MSME sector, which as of a January 2026 Ministry of MSME fact-sheet contributes about 31.1% to GDP, 35.4% to manufacturing output and 48.58% to exports, and employs more than 38.9 crore people, continues to digitize rapidly, a shift that has expanded the sector’s exposure to cyber risk even as it drives growth.
India’s manufacturing base is also deepening its role in global value chains, with the Manufacturing PMI at 55.4 in January 2026 reflecting sustained momentum and electronics sector domestic value addition rising from 30% to 70%, projected to reach 90% by FY27. This deepening integration has increased the number of SMBs whose systems and data are linked to larger enterprise networks, raising the stakes of the trusted relationship attacks referenced above.
To keep Indian SMBs protected from ransomware, Kaspersky experts recommend:
- Always keeping software updated on all devices to prevent attackers from exploiting known vulnerabilities to infiltrate the network.
- Focusing the defense strategy on detecting lateral movement and data exfiltration to the internet, and paying special attention to outgoing traffic to detect connections from cybercriminals. Setting up offline backups that intruders cannot tamper with, and making sure they can be accessed quickly when needed or in an emergency.
- Installing anti-APT and EDR solutions that enable capabilities for advanced threat discovery and detection, investigation and timely remediation of incidents.
- Strengthening teams’ skills in incident prevention, detection and response through dedicated cybersecurity training for IT staff.
- Giving SOC teams access to Kaspersky Threat Intelligence to stay ahead of evolving ransomware tactics and commonly exploited weaknesses.
