AI and Cyber Threats in India

Context: A cybersecurity analysis highlighted how Artificial Intelligence (AI) is transforming offensive cyber operations against India into automated, scalable, and autonomous campaigns.

About AI and Cyber Threats in India:

What It Is?

• The convergence of AI and cyber threats refers to the weaponization of frontier Large Language Models (LLMs), machine learning algorithms, and autonomous AI agents across the cyber kill chain.
• Attackers leverage AI to automate target reconnaissance, generate evasive polymorphic code, mass-produce synthetic deepfakes, and autonomously uncover software zero-day vulnerabilities, shifting offensive cyber warfare from human-speed operations to machine-speed execution.

Key Data & Statistics on Cyber Threats in India:

• High Global Victim Ranking: Cyber intelligence firm CloudSEK ranked India as the second-most cyber-attacked nation globally in 2024 and sixth in 2025.
• Targeting Strategic Nuclear & Energy CNI: Ransomware groups (e.g., World Leaks) recently claimed breaches of data and blueprints linked to India’s largest nuclear facility, the Kudankulam Nuclear Power Plant.
• State-Sponsored Hybrid Warfare Campaigns: During Operation Sindoor, Pakistan-backed Advanced Persistent Threat groups (such as APT36) targeted the Ministry of Defence, Army, Navy, DRDO, National Informatics Centre (NIC), and Bharat Operating System Solutions (BOSS Linux).
• Massive Adoption Velocity: While the Internet took 15 years to cross one billion global users, generative AI platforms achieved that milestone in just three years, accelerating the democratization of offensive cyber tools.

How AI Is Transforming Cyber Threats?

• Automated Reconnaissance & Hyper-Personalized Phishing: LLMs rapidly scan social media, professional registries, and corporate portals to craft authentic, multilingual spear-phishing emails and real-time deepfakes without human intervention.
• LLM-Generated Polymorphic Malware: AI autonomously generates, mutates, and restructures malware code in real time, bypassing traditional static signatures and conventional antivirus firewalls.
• Autonomous Agentic Cyber Espionage: State-backed groups deploy AI agents (e.g., Chinese threat actor GTG-1002 using autonomous coding agents) to orchestrate end-to-end cyber espionage campaigns across multiple network stages.
• Large-Scale Autonomous Zero-Day Discovery: Frontier AI models (such as Claude Mythos) can autonomously analyze millions of lines of source code to discover zero-day vulnerabilities—such as legacy bugs in hardened operating systems like OpenBSD—and generate weaponized exploits within minutes.
• Threat to Operational Technology (OT) & Industrial Control Systems (ICS): AI-driven exploitation directly targets industrial control systems governing power grids, chemical plants, oil refineries, and pharmaceutical manufacturing facilities.

Challenges & Vulnerabilities for India:

• Underdeveloped Sovereign AI Stack: India lags behind the US and China across foundational components of the AI value chain, including foundational models, advanced GPUs, proprietary chip designs, and high-performance computing clusters.
• Heavy Foreign Technology Dependency: Reliance on imported hardware, proprietary foreign operating systems, and foreign-hosted cloud data centers creates structural vulnerabilities for Indian digital infrastructure.
• Inadequacy of Traditional Cyber Defenses: Legacy perimeter firewalls and periodic patch schedules are ineffective against self-evolving, polymorphic AI malware that adapts continuously.
• Expansion of the IoT/Smart-City Attack Surface: The rapid rollout of smart power grids, urban IoT devices, and connected physical infrastructure expands the perimeter accessible to automated AI scrapers.
• Shortage of Skilled AI-Cybersecurity Talent: A significant deficit of specialized professionals trained in machine-learning threat hunting, prompt security, and automated incident response across public and private sectors.

Initiatives Taken So Far:

• CERT-In Frontier AI Security Advisories & Frameworks: The Indian Computer Emergency Response Team (CERT-In) has operationalized AI-driven threat detection systems, sandbox vulnerability assessments, and issued comprehensive defense guidelines against frontier AI risks.
• MeitY Governance & Synthetic Content Regulations: The Ministry of Electronics and Information Technology is formulating consent-based synthetic content frameworks, guardrails on autonomous agentic AI, and clear liability regimes for AI model developers.
• National AI Capacity Building & Exercises: CERT-In conducts nationwide cyber drills on Building Resilience against Frontier AI-driven Cyber Threats, alongside accredited programs like the Certified Security Professional in AI (CSPAI).

Way Ahead:

• Developing Sovereign AI & Compute Infrastructure: Invest heavily in sovereign foundational models, secure semiconductor supply chains, and domestic data centers to reduce reliance on foreign technology stacks.
• Deploying AI for Automated Cyber Defense: Shift from human-dependent triage to autonomous, machine-speed defensive systems capable of detecting network anomalies, isolating compromised endpoints, and auto-deploying patches.
• Strict Air-Gapping & Security Auditing of Critical CNI: Mandate zero-trust architectures, strict air-gapping, and continuous red-teaming across industrial control systems, nuclear sites, defense grids, and banking networks.
• Enacting Clear AI Liability & Security Standards: Legally require AI developers to run red-team vulnerability testing before public deployment and hold developers accountable for software weaknesses exploited via agentic workflows.
• Engaging in Strategic Technology Partnerships: Secure India’s role in trusted multilateral groupings like Pax Silica to collaborate on cyber threat intelligence, secure hardware supply chains, and global standards for dual-use AI.

Conclusion:

The rapid weaponization of Artificial Intelligence marks a fundamental shift in cyber warfare, giving threat actors unprecedented speed, automation, and adaptability to target India’s critical infrastructure. Defending against autonomous AI campaigns requires modernizing traditional security frameworks and closing the global AI divide. By investing in sovereign AI capabilities, deploying automated defenses, and enforcing rigorous security standards, India can build a resilient defense to protect its digital sovereignty.