Cyber Threats Taxonomy – APT, Ransomware, Phishing, and Zero-Day Exploits
Cybersecurity has emerged as one of the most critical dimensions of national security in the digital age. As India accelerates digital infrastructure deployment — from UPI and DigiLocker to Smart Cities and Critical Information Infrastructure — the attack surface for cyber threats has expanded dramatically. Understanding the taxonomy (classification system) of cyber threats is fundamental for designing effective policy responses. CERT-In, NCIIPC, and regulatory bodies like SEBI and RBI have articulated India-specific threat landscapes. For UPSC aspirants, cyber threats must be understood not merely as technical phenomena but as policy, governance, and security challenges.
Cyber threats can be classified by actor (state/non-state), intent (espionage/disruption/financial), method (malware/social engineering/exploitation), and target (individuals/corporations/critical infrastructure). The key threat categories include: Advanced Persistent Threats (APTs) — state-sponsored long-duration attacks; Ransomware — encrypting and extorting data; Phishing — deceptive social engineering; and Zero-Day exploits — attacks leveraging unknown software vulnerabilities. India recorded over 2.2 million cyber incidents between 2021 and mid-2025 (CERT-In data). The primary legal framework is the IT Act 2000 (amended 2008), supplemented by CERT-In directives 2022 and the Digital Personal Data Protection Act 2023.
📌 Revision Pointers
CERT-In: Indian Computer Emergency Response Team; nodal agency under IT Act 2000; under MeitY
NCIIPC: National Critical Information Infrastructure Protection Centre; under NTRO/PMO
APT: Advanced Persistent Threat — long-duration, stealthy, often state-sponsored
Zero-day: Vulnerability unknown to the software vendor; no patch available
Ransomware: Malware encrypting victim's data; demands ransom (usually crypto) for decryption key
Phishing: Deceptive emails/messages mimicking trusted entities to steal credentials
Spear phishing: Targeted phishing (specific individual/organisation)
DDoS: Distributed Denial of Service — flooding a server to crash it
Critical Information Infrastructure (CII): Designated by NCIIPC; attack on it = national security threat
IT Act 2000, Sec 70: Protection of protected systems (CII)
CERT-In Directions 2022: Mandatory 6-hour incident reporting; VPN/cloud logs to be kept 5 years
DPDP Act 2023: Data privacy legislation; introduces personal data breach obligations
India cyber incidents: 2.2 million+ (2021 to mid-2025), ~3,000 attacks per day (CERT-In)
Taxonomy of Cyber Threats by Type
Advanced Persistent Threats (APTs)
APTs are sophisticated, long-duration cyberattacks typically conducted by state-sponsored or highly organised groups. Key characteristics:
Stealthy: Designed to remain undetected for months or years
Targeted: Aimed at specific high-value organisations (defence, government, financial, critical infrastructure)
Multi-stage: Initial compromise → lateral movement → data exfiltration or sabotage
Examples: Stuxnet (Iran's nuclear facility), APT41 (China), APT28/Fancy Bear (Russia)
India context: Indian defence, space, and government networks have been targets of APT groups linked to China and Pakistan (e.g., SideWinder, Transparent Tribe)
Ransomware
Ransomware is malicious software that encrypts a victim's files and demands a ransom (typically in cryptocurrency) for the decryption key.
Double extortion: Modern ransomware first exfiltrates data, then encrypts it — threatens to leak data publicly if ransom unpaid
Notable attacks: WannaCry (2017, exploited EternalBlue NSA exploit); Colonial Pipeline (2021, US); AIIMS Delhi (2022, ransomware encrypted patient data)
Ransomware-as-a-Service (RaaS): Ransomware developers lease their tools to affiliates — lowering barrier to entry
India: Financial sector, healthcare, and government PSUs are primary targets
Phishing and Spear Phishing
Phishing involves fraudulent communications (emails, SMS, websites) that impersonate legitimate entities to steal credentials, financial information, or install malware.
Phishing: Mass, untargeted — targets thousands simultaneously
Spear phishing: Targeted at specific individuals using personalised details (name, role, organisation)
Whaling: Spear phishing targeting senior executives (CEOs, Ministers)
Vishing: Voice phishing via telephone
Smishing: SMS phishing
AI-generated phishing: Large language models now used to craft near-perfect phishing emails in local languages — exponentially increasing effectiveness
India context: RBI has repeatedly warned of phishing impersonating bank customer care; UPI fraud often starts with phishing
Zero-Day Exploits
A zero-day vulnerability is a software flaw unknown to the vendor and therefore unpatched. A zero-day exploit is an attack leveraging such a vulnerability.
'Zero-day' refers to the fact that developers have had 'zero days' to fix the vulnerability
Highly prized: Zero-days are sold on dark web markets and by companies like NSO Group (Pegasus)
Pegasus: Israeli spyware using zero-day exploits in WhatsApp and Apple iOS to infect devices without user action; Indian journalists, activists, and politicians were reportedly targeted
Patch management: After vendor discovers and releases a patch, organisations must update quickly — unpatched systems remain vulnerable
Other Threat Categories
Malware: Umbrella term — includes viruses, worms, trojans, spyware, adware
DDoS (Distributed Denial of Service): Uses botnets (networks of compromised computers) to overwhelm servers
Man-in-the-Middle (MitM): Attacker intercepts communication between two parties
SQL Injection: Inserting malicious SQL code into input fields to manipulate databases
Social Engineering: Psychological manipulation to trick individuals into revealing information or performing actions
Insider Threats: Malicious or negligent actions by employees, contractors with system access
Classification by Actor
State-sponsored (Nation-state): Highest sophistication; APT groups; examples: China's APT41, Russia's APT28, North Korea's Lazarus Group
Organised crime groups: Financially motivated; ransomware operations
Hacktivists: Ideologically motivated; DDoS, website defacement
Script kiddies: Low-skill attackers using pre-built tools
Insider threats: Current/former employees
Important Concepts/Subtopics
India's Cybersecurity Institutional Framework
CERT-In (MeitY): Nodal agency; incident response; advisories; mandatory incident reporting (6 hours for critical sectors since 2022)
NCIIPC (NTRO/PMO): Protects Critical Information Infrastructure (CII) sectors — power, banking, telecom, transport, government, space
Cyber Suraksha Kendra: Sector-specific SOCs (Security Operations Centres)
National Cyber Security Coordinator (NCSC): PM's Office level; coordinates across agencies
DSCI (Data Security Council of India): Industry body; publishes annual India Cyber Threat Report
Legal Framework
IT Act 2000: Primary cybersecurity legislation; criminalises hacking (Sec 66), identity theft (Sec 66C), cyber terrorism (Sec 66F)
IT (Amendment) Act 2008: Added cyber terrorism provisions; established CERT-In as statutory body
CERT-In Directions April 2022: Mandatory reporting of 20 types of incidents within 6 hours; VPN providers must maintain user logs 5 years — controversial for privacy
DPDP Act 2023 (Digital Personal Data Protection): Mandates personal data breach notification to DPBI; penalties up to Rs 250 crore
IT Act Sec 70: Notified 'Protected Systems' (CII); unauthorised access = 10-year imprisonment
CERT-In 2022 Directions – Controversy
CERT-In's April 2022 mandatory directions required VPN providers and cloud services to store detailed user logs for 5 years. Critics argued this:
Violates user privacy and chills free expression
Forces VPN companies to undermine their core privacy promise
May be disproportionate to stated cybersecurity objective
Several VPN providers (NordVPN, ExpressVPN, Surfshark) temporarily withdrew Indian servers in protest.
Current Relevance
AIIMS Delhi ransomware attack (November 2022): Patient data of 40 million encrypted; exposed vulnerability of public health IT systems
India's G20 Presidency (2023): Cyber norms for state behaviour in cyberspace featured prominently
Operation Sindoor (2025): Cyberattacks on Indian infrastructure reportedly spiked in parallel with kinetic operations — demonstrating cyber-physical nexus
India Cyber Threat Report 2025 (DSCI): 2.2 million+ incidents; financial services and healthcare most targeted
AI-powered cyberattacks: LLM-generated phishing; automated vulnerability scanning; adversarial AI — raising the threat bar significantly
DPDP Act 2023: Operationalisation underway; will create new obligations for organisations handling personal data
💭 Conclusion
Cyber threats are no longer peripheral security concerns — they are central to national security, economic stability, and democratic governance. India's rapid digitalisation makes it simultaneously one of the world's fastest-growing digital economies and one of the most targeted cyber environments. A taxonomy-based understanding of cyber threats helps policymakers design layered defences: technical measures (patch management, encryption, intrusion detection), legal measures (IT Act, DPDP, CERT-In mandates), and institutional measures (NCIIPC, sector-specific SOCs). For UPSC aspirants, cyber threats link naturally to topics in internal security, governance, technology policy, and international relations — making this a highly cross-cutting syllabus area.
GS3 | Science & Technology | Cybersecurity | PrepCat Notes | 2026-06-16