AHMEDABAD (INDIA) — Cyble, the global AI-native cybersecurity company, and DRONA Cyber Solutions, the Ahmedabad-headquartered security operations firm, have launched an AI-powered cyber defense initiative in Ahmedabad, combining threat intelligence, investigation and endpoint enforcement through a joint managed security model.

The AI-Powered Intelligence for Cyber Defense initiative was formally launched Tuesday at DRONA Cyber Solutions' Command and Control Centre, where the companies presented a live technical demonstration showing how an intrusion attempt can be detected, investigated and contained.

The launch comes as India faces a growing cybercrime burden. India recorded 28.15 lakh cybercrime cases in 2025, a 24 percent increase over the previous year, with reported losses reaching ₹22,495 crore. The government's 1930 cybercrime helpline received 32.4 million calls during the year. Of the complaints filed, 55,484 were converted into FIRs. While large enterprises and banks increasingly have dedicated security teams, budgets and incident response capabilities, many manufacturers, hospital chains, schools and mid-sized businesses, particularly across Tier-2 and Tier-3 cities, continue to operate without comparable security resources.

AI-Powered Cyber Defense Takes Center Stage in Ahmedabad

Rather than focusing solely on formal remarks, Cyble and DRONA used the launch to demonstrate the initiative through a live technical exercise for the media. The demonstration began with material recovered from infostealer logs circulating on a criminal forum, alongside a lookalike domain registered to impersonate a target organisation. Analysts traced the infrastructure, established a pattern of previous activity associated with the same actor and demonstrated the detection and containment of an intrusion attempt on an endpoint.

The final containment action was authorised by a human analyst rather than executed automatically. The demonstration brought together multiple capabilities. Cyble Vision provided the initial detection through continuous monitoring of criminal marketplaces and leak sites.

Cyble Hawk supported the investigative process and attribution, while Cyble Titan handled endpoint enforcement, using hardware-level integrity checks to support its assessment. DRONA analysts remained at the centre of the process, making decisions that the system was deliberately not permitted to make independently. Mandar Patil, Executive Vice President at Cyble, said the initiative was designed to address a longstanding gap between threat detection and action for mid-sized businesses.

"India is not short of alerts. It is short of what happens next," Patil said. "We have spent a long time in this industry watching mid-sized businesses get told about a threat and then having nowhere to take that information. What we are launching today is not another alert. It is a complete chain — intelligence before the attack, investigation that would stand up to scrutiny, enforcement on the device, and a person accountable for the decision at the end of it."

Dhruv Pandit, Co-Founder and CEO of DRONA Cyber Solutions, said the initiative reflects the operational needs of organisations that require immediate action rather than another security dashboard.

"A factory owner calling us at two in the morning does not want to be shown a dashboard," Pandit said. "He wants to know what happened, he wants it contained, and he wants someone to take responsibility for what happens next."

From the Command Centre to Gujarat University, India

The Gujarat University engagement was not simply a conventional cybersecurity student session. It was a technical session titled “Kavach: Beyond the Surface — Threat Intelligence from the Dark Web Depths,” hosted by the Department of Biochemistry and Forensic Science, Gujarat University, in collaboration with Cyble.

The session brought together speakers from Cyble and DRONA Cyber Solutions to examine areas including dark web threat intelligence, government and PSU cybersecurity projects, digital forensics and incident response (DFIR), and the transition of threat intelligence from information to action.

Mandar Patil and Augustin Kurian of Cyble discussed the dark web threat intelligence landscape. Prathmesh Pawar spoke about government and PSU cybersecurity projects, while Brijesh Kapadiya addressed DFIR and Vijay Mali discussed moving threat intelligence from information to action. The keynote was delivered by Prof. Dr. Kapil Kumar, Coordinator, Department of Biochemistry and Forensic Science.

The session highlighted several practical aspects of cybersecurity work. The dark web was discussed not simply as a hidden part of the internet, but as a structured ecosystem requiring dedicated intelligence-gathering and threat-discovery methods. DFIR was presented as an area where speed and process are as important as technical expertise.

Another key takeaway was the importance of turning threat intelligence into action. Rather than treating intelligence as information alone, the session focused on how it can inform practical security decisions.

Patil told students that the cybersecurity industry faces a shortage of professionals with practical skills in analysing and validating threat intelligence.

"The gap this industry has is not a gap of ideas. It is a gap of people who know how to do the work," Patil said. "What separates a useful analyst from an alert-reader is the ability to ask whether a piece of intelligence is actually true before you act on it."

Augustin Kurian, Editor-in-Chief of The Cyber Express, told students that threat intelligence and journalism share an emphasis on verification.

Every story we publish about a breach, a ransomware group or a leaked database starts exactly where today's demonstration started — with intelligence somebody had to go and find, verify, and decide was worth acting on," Kurian said. The instinct we have tried to build at The Cyber Express is the same instinct a good analyst needs: do not report, and do not act on, what you have not verified.

The programme also involved technical and production teams supporting the session. Screen, sound and lighting were handled by the technical team under the guidance and supervision of Aditya More, while Misha Alagiya, Kavya Maharaja, Pathak Ami, Omi and Nandini supported stage management and photography.

A Broader Cybersecurity Collaboration

Both companies emphasised that the partnership is not intended to represent a single solution to India's cybersecurity deficit. Cyble and DRONA maintain relationships with other partners, service providers and government bodies.

"India's exposure is too large for any single partnership to take credit for solving," Patil said. "What matters is whether more of these collaborations exist a year from now, and whether the businesses we are talking about today — the ones without a security team — actually have somewhere to turn."

The AI-Powered Intelligence for Cyber Defense initiative will be delivered through DRONA's Ahmedabad command centre, with the companies indicating an intent to extend the service model to customers elsewhere in India over time.

The initiative also folds into DRONA's existing Cyber Yodha Campaign, a national programme aimed at building 50 integrated cybersecurity command centre labs and training more than 100,000 defenders.

Ransomware often dominates cybersecurity headlines, but stolen data has become an equally valuable commodity in the cybercrime economy. In the first half of 2026, one threat actor stood out in the data leak ecosystem: Tanaka, a prolific data leak broker responsible for more publicized leak activity than any other actor tracked by Cyble.  Cyble researchers recorded 367 data breach and leak incidents worldwide between January and June 2026. While dozens of actors participated in selling or publishing stolen information, Tanaka emerged as the most active, accounting for 25 distinct leak posts — more than double the activity of several other major actors. 

A Data Leak Operation Without Industry Boundaries 

Unlike threat actors that specialize in a single vertical, Tanaka followed a broad targeting approach across multiple industries and regions. The actor’s campaigns showed no strict preference for a specific sector, instead focusing on organizations where stolen information could hold financial or strategic value.  The Banking, Financial Services, and Insurance (BFSI) sector remained the most targeted industry globally, accounting for 38 breach incidents during the reporting period. Financial organizations continue to attract attackers due to the value of customer information, account data, and personally identifiable information (PII).  Government and Technology organizations were also frequent targets, reflecting the wider value of sensitive records, intellectual property, and institutional data. 

Regional Presence Across Major Markets 

Tanaka’s activity was visible across multiple regions. In North America, the actor was responsible for seven leak posts, making it the most active data leak actor in the region alongside other prominent sellers.  Europe and the UK also saw significant activity, with Tanaka linked to six leak posts during H1 2026. The region’s BFSI, Telecommunications, and Retail sectors faced heightened exposure due to the amount of valuable customer and financial data they hold.  The actor’s global footprint demonstrates how modern data leak operations can function independently of geography. Instead of focusing on a single country or industry, operators like Tanaka exploit opportunities wherever valuable information becomes available. 

The Rise of the Data Leak Marketplace 

Tanaka’s activity reflects a broader shift in the cybercrime ecosystem. Data leaks are no longer only a byproduct of ransomware attacks; they have become a standalone business model.  Threat actors monetize stolen information through underground marketplaces, using leaked databases for fraud, extortion, intelligence gathering, or resale. This specialization mirrors other parts of the cybercrime economy, where access brokers, ransomware affiliates, and data sellers perform separate roles.  For organizations, this means a breach does not always begin with a ransomware demand. A stolen database appearing in underground channels may indicate an earlier compromise that requires immediate investigation. 

Staying Ahead of Data Exposure Risks 

Security teams must treat underground data exposure monitoring as part of their broader defense strategy. Identifying leaked credentials, compromised databases, or mentions in cybercrime marketplaces can provide early warning before stolen information is weaponized.  To understand the 2026 data breach landscape, including the most active threat actors, targeted industries, and regional trends, access the full Cyble H1 2026 Cyber Threat Landscape Report. 

Strip away the geopolitics, the hacktivist noise, and the espionage headlines, and one number from the first half of 2026 stands out above everything else: 1,721. That's how many ransomware attacks hit organizations in the United States between January and June, according to new research from Cyble Research and Intelligence Labs (CRIL). It's not just the highest total of any country tracked in the report — it's more than the next nine most-targeted countries combined.

Canada, in second place worldwide, recorded 179 attacks. Germany logged 155. The United Kingdom, 138. Add up the rest of the global top 10 — France, Italy, Spain, Thailand, India and Brazil — and the total still falls more than 600 attacks short of the U.S. figure alone. Out of 3,836 ransomware attacks CRIL tracked worldwide this half, roughly 45% landed on American soil.

Also read: Fairlife Ransomware Attack Hits Production Systems, U.S. Operations Suspended

A Single Region, an Outsized Share

Widen the lens slightly and the picture holds. North America as a whole recorded 1,981 ransomware attacks in H1 2026 — more than half of every ransomware incident Cyble observed globally — alongside 35 data breach and leak incidents and 9 initial access sale listings. The report describes the region as home to "a mature, persistently active RaaS ecosystem operating at high volume across a wide range of industries and geographies."

Two ransomware-as-a-service operators did much of the damage. Qilin, the single most prolific gang worldwide, claimed 370 of those North American attacks on its own — nearly 19% of the regional total. Akira followed with 268, and INC Ransom added another 164. Together, Qilin and Akira alone accounted for more than half of all recorded ransomware activity across the region, a level of concentration that points to a small number of highly organized affiliate networks doing the bulk of the damage rather than a diffuse swarm of opportunists.

Also read: Qilin Ransomware Group’s TTPs Examined by Researchers

Where the Pressure Lands

Professional Services bore the brunt of North American ransomware activity, with INC Ransom showing a marked preference for law firms and other high-value services with sensitive client data. Construction, Manufacturing and Healthcare followed close behind.

One operator, AiLock, stood out for a coordinated wave of victim disclosures that all landed on the same day — March 3 — a pattern consistent with a mass-exploitation campaign rather than isolated intrusions. LockBit, despite years of law enforcement pressure and takedown attempts, kept up a steady tempo against public-sector and educational targets throughout the period, showcasing how difficult the group has been to fully dismantle.

On the data breach side, Technology and financial services (BFSI) were the most frequently targeted sectors in North America, together accounting for roughly 43% of incidents — a reflection of how much intellectual property and monetizable personal data those industries hold.

Notably, Agriculture & Livestock emerged as a significant target for initial access brokers, accounting for a third of all access listings tied to the region. Cyble flags this as a sign of "growing risk in the food supply chain," an area that has historically drawn less attention from ransomware operators than finance or healthcare.

The initial access market itself was strikingly concentrated: two sellers, tracked under the handles "redpin" and "xpl0itrs," accounted for nearly all listings targeting North American organizations. Threat actors also continued to lean on known and zero-day vulnerabilities in widely deployed enterprise platforms — including products from Ivanti and Palo Alto Networks — as their preferred way into corporate networks.

Hacktivism Blurs into Cybercrime

North America wasn't spared the hacktivism wave sweeping the rest of the world either. Collectives including SOLDADOS DIGITALES – UNIÓN AMERICANA and LYSTIC TEAM #ID drove roughly 56 data leak or dump posts and touched about 360 unique domains across the region, with Government, Technology, financial services and telecommunications entities most frequently in the crosshairs.

Cyble's broader findings suggest many groups marketing themselves as ideologically driven hacktivists are, in practice, running side businesses in stolen data brokerage and DDoS-for-hire services — a blurring of motive that complicates how defenders triage the threat.

The scale of the U.S. numbers doesn't necessarily mean American companies have weaker defenses than their global peers — the concentration also reflects the sheer size and digital density of the U.S. economy, and its outsized share of the high-value targets ransomware affiliates chase. But the data does argue for a shift in posture.

Cyble's broader recommendations — treating data exfiltration, not just encryption, as the primary risk; prioritizing patches for the recurring vendor list; and monitoring initial access markets as a leading indicator rather than an afterthought — apply nowhere more urgently than in a country absorbing this much of the world's ransomware volume on its own.

The FIFA World Cup 2026 may not kick off until June 11, 2026, but cybercriminals have already begun exploiting anticipation surrounding the tournament. Security researchers and law enforcement agencies are warning that FIFA World Cup 2026 scams are actively targeting fans, job seekers, and businesses through fake websites, phishing campaigns, and fraudulent online services.  The FBI recently issued a Public Service Announcement warning that threat actors are creating fraudulent versions of FIFA-affiliated websites to steal personal information, conduct financial fraud, and sell fake products and services. Researchers at Cyble independently reviewed the FIFA domains identified by the FBI and confirmed that many remained active at the time of analysis.  With 48 teams competing across 16 host cities in the United States, Canada, and Mexico, the tournament is expected to attract billions of viewers worldwide, making it an attractive target for cybercriminal activity. 

Fake FIFA Domains and Typosquatting Attacks 

According to the FBI, attackers are building websites that closely resemble FIFA’s official platform, www.fifa.com. These sites are designed to collect personally identifiable information (PII), including names, addresses, email accounts, banking information, and payment card details.  Many of these operations rely on a typosquatting attack, a technique in which criminals register lookalike FIFA domains featuring slight spelling changes, missing characters, or alternative extensions. Examples identified by the FBI include fifa[.]help, fifa-online[.]com, jobs-fifa[.]com, fifa-ticket[.]live, fifa-hiring[.]com, and ww-fifa[.]com.  Cyble researchers noted that malicious FIFA domains often reappear quickly after takedowns, indicating a continuously evolving fraud infrastructure rather than isolated campaigns. 

Ticket, Hospitality, and Recruitment Fraud 

One of the most convincing examples analyzed by researchers was ww-fifa[.]com, a typosquatting attack that removes a single "w" from the legitimate FIFA address. The site presented itself as an official FIFA World Cup 2026 portal and promoted premium hospitality packages that allegedly included tickets, food, beverages, lounge access, and other services.  Researchers identified several red flags, including broken images, duplicate page titles, suspicious navigation links, and requests for personal and financial information through illegitimate payment forms.  Cyble also uncovered employment-related FIFA World Cup 2026 scams. The domain fifaworldcup-careers[.]com impersonated a FIFA recruitment portal offering World Cup-related positions. VirusTotal data showed that the website was flagged by 8 of 91 security vendors, while the root domain was flagged by 14 of 91 vendors. [caption id="" align="aligncenter" width="936"] Fake FIFA 2026 domain scoring (Source: Cyble)[/caption] WHOIS records revealed that the domain was registered and updated in April 2026, with the registrant's identity hidden behind privacy protection services. Researchers also found two SSL certificates issued on April 15 and April 16, including a wildcard certificate covering subdomains.

How Fans Can Stay Safe 

The FBI advises users to type www.fifa.com directly into their browser rather than relying on search engine results, sponsored advertisements, or links received through messages. Users should verify URLs carefully, save official pages as bookmarks, and avoid sharing sensitive information unless a site's legitimacy has been independently confirmed.  The agency also warns that fraudulent streaming platforms are likely to increase as the tournament approaches. Fans should rely only on official FIFA channels and licensed broadcasters when searching for FIFA World Cup 2026 content.  Anyone who encounters a suspected scam should preserve screenshots, domain information, communication records, and payment details before reporting the incident to the Internet Crime Complaint Center (IC3). With FIFA World Cup 2026 scams already active and new FIFA domains appearing regularly, experts warn that vigilance will be critical throughout the tournament period. 

Cyber threats across the Middle East, Turkey, and Africa (META) continued to intensify in the first quarter of 2026, with ransomware groups, hacktivist campaigns, and large-scale data breaches shaping a volatile threat landscape for organizations across the region. According to Cyble’s latest META Threat Landscape Report, ransomware remained one of the most disruptive threats during Q1 2026, with attacks targeting industries ranging from government and construction to banking and energy. The findings also point to a growing overlap between financially motivated cybercrime and geopolitically driven cyber activity.

Ransomware Attacks Continue to Rise

Researchers observed 116 ransomware incidents publicly disclosed across the META region during the first three months of 2026. Turkey recorded the highest number of attacks, followed by the UAE, while countries including South Africa and Egypt also faced significant ransomware activity. Among the most active threat groups was Gentlemen, which accounted for a notable share of observed attacks during the quarter. Other ransomware operators including INC Ransom, Qilin, Tengu, and LockBit also remained highly active. Construction emerged as the most targeted industry, followed closely by government agencies, law enforcement organizations, financial services, and energy companies. These sectors often manage sensitive operations and critical infrastructure, making them attractive targets for cybercriminals seeking maximum disruption and financial leverage. The Cyble report also highlights how ransomware operations are becoming increasingly organized, with many groups continuing to operate under ransomware-as-a-service models that allow affiliates to scale attacks rapidly.

Data Breaches Expose Sensitive Information

Beyond ransomware, underground forums remained flooded with stolen databases and claims of unauthorized access linked to organizations across the region. Threat actors allegedly offered access to sensitive data connected to sectors such as hospitality, healthcare, sports, influencer marketing, and energy. In one case, a threat actor claimed to possess terabytes of information linked to Qatar’s energy sector, including credentials and cloud backups. Government and public sector organizations also remained frequent targets, reflecting growing concerns around espionage, politically motivated operations, and long-term intelligence gathering.

Vulnerability Exploitation Driving Intrusions

The report notes that attackers continue to move quickly after new vulnerabilities become public. Several high-severity flaws disclosed during the quarter were rapidly added to the CISA Known Exploited Vulnerabilities catalog, reinforcing how threat actors are actively monitoring enterprise technologies for exploitable weaknesses. Enterprise management systems, security tools, and internet-facing applications remained among the most targeted technologies. One of the more notable cases involved a critical Ivanti Endpoint Manager Mobile vulnerability that could allow unauthenticated remote code execution. Researchers say such flaws continue to attract threat actors because they provide a pathway into enterprise environments without requiring stolen credentials.

META Threat Landscape Report Highlights Geopolitical Tensions

Hacktivist activity also remained elevated throughout Q1 2026. Researchers tracked hundreds of posts related to data leaks, website defacements, and distributed denial-of-service attacks affecting thousands of domains across the META region. Much of this activity appeared linked to ongoing geopolitical tensions, particularly conflicts involving Israel, Iran, and neighboring regions. Threat actors increasingly used cyber operations not just for disruption, but also to amplify political messaging and influence public narratives online. The report suggests that organizations operating in politically sensitive regions may continue to face elevated cyber risks throughout the year.

A Growing Need for Proactive Cyber Defense

The findings from Q1 2026 reflect a broader shift in the threat landscape, where cyberattacks are becoming faster, more coordinated, and more difficult to contain. For organizations across the META region, visibility into emerging threats, exposed assets, ransomware activity, and vulnerability exploitation is becoming increasingly important as attackers continue to evolve their tactics. The full META Threat Landscape Report offers a closer look at the threat groups, industries, and attack trends shaping the region’s cybersecurity environment in early 2026. Readers interested in ransomware trends, regional targeting patterns, and emerging cyber risks can explore the Cyble report for deeper insights into how the threat landscape is evolving.