Skip to navigation

Threat reportThreat IntelligenceTL-2026-5895

Ransomware without data theft may trigger mandatory breach reporting under India's DPDP framework (K7 CyberSecurity)

MONITORING

K7 CyberSecurity says ransomware that makes personal data inaccessible, even without data theft, may be a reportable personal data breach under India's DPDP framework, with no minimum breach-size exemption. Affected individuals and the Data Protection Board must be notified without delay, with a detailed report due within 72 hours of awareness unless extended.

Key facts

IdentifiersTL-2026-5895
Also known asDPDP Rules 2025 ransomware breach reporting
SeverityINFO
First disclosed
Affected productsN/A Data fiduciaries processing personal data of individuals in India
MITRE ATT&CK techniquesT1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1490 Inhibit System Recovery, T1685 Disable or Modify Tools
MotivationUNKNOWN
Target sectorsall sectors processing personal data in india
Target regionsindia
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5895 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Server Process Spawning Shell or LOLBin — Ransomware Initial Access (T1190)

TL-2026-5895 (K7 / DPDP Rules ransomware-reporting intel) is regulatory intelligence with no named malware or infrastructure, so detections are behaviour-first on the ransomware lifecycle that ends in T1486 data encryption and loss of availability of personal data. This rule detects the exploitation stage: an internet-facing web or application server process (IIS w3wp, Apache httpd, nginx, Tomcat, php-cgi, java) spawning a command interpreter or download LOLBin, the typical result of exploiting a public-facing application (T1190) before ransomware staging. Early detection supports the DPDP Rule 6 safeguard and Rule 7 incident-evidence expectations.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059
  • Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*w3wp.exe" OR ParentImage="*httpd.exe" OR ParentImage="*nginx.exe" OR ParentImage="*tomcat*.exe" OR ParentImage="*php-cgi.exe" OR ParentImage="*java.exe") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*mshta.exe" OR Image="*certutil.exe" OR Image="*bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host ParentImage Image User | convert ctime(first_seen) ctime(last_seen) | sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "java.exe", "tomcat9.exe", "tomcat10.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Web Server Process Spawning Shell or LOLBin
id: 5b0f7c1e-3a64-4d2b-9e1a-7c4a2f6d8b11
status: experimental
description: Detects an internet-facing web or application server process spawning a command interpreter or download LOLBin, consistent with exploitation of a public-facing application (T1190) ahead of ransomware staging (T1486). Related to TL-2026-5895.
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://www.freepressjournal.in/business/indias-dpdp-rules-put-ransomware-attacks-under-the-scanner-k7-cybersecurity-flags-hidden-compliance-risks-for-businesses
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\java.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Web applications that legitimately shell out for administration or deployment tasks
    - Java-based management consoles launching helper scripts
level: high

Known false positives:

  • Web applications that legitimately invoke cmd.exe or powershell.exe for deployment or health-check tasks
  • Java-based admin consoles (e.g. Tomcat manager, Jenkins) launching helper scripts

Tuning notes: Baseline the (ParentImage, Image, CommandLine) tuples for 14 days and allowlist known deployment/health-check commands; restrict ParentImage to internet-facing hosts via an asset lookup; add Linux auditd/Sysmon-for-Linux equivalents (httpd/nginx/tomcat spawning sh/bash) where relevant.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Password Spray Followed by Successful Sign-in from Same IP — Valid Account Abuse (T1078) · unlock with TL Creds
  • Microsoft Defender Tampering via Set-MpPreference, Exclusions or Service Stop — Impair Defenses (T1562) · unlock with TL Creds
  • Mass File Rename Burst by a Single Process — Data Encrypted for Impact (T1486) · unlock with TL Creds
  • Ransomware Recovery-Instruction File Creation — Data Encrypted for Impact (T1486) · unlock with TL Creds
  • Boot Recovery and Backup Destruction via bcdedit, wbadmin or vssadmin Resize — Inhibit System Recovery (T1490) · unlock with TL Creds
  • Backup and Database Service Stop Before Encryption — Pre-Encryption Impact Staging (T1489) · unlock with TL Creds
  • Shadow Copy Deletion via vssadmin, WMIC, PowerShell or diskshadow — Inhibit System Recovery (T1490) · unlock with TL Creds
  • SMB Admin Share Executable Staging Across Multiple Hosts — Ransomware Lateral Movement (T1021.002 / T1078) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5895.

6 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This is regulatory and compliance intelligence, not an exploited vulnerability or a named-actor campaign. No CVE, malware family, threat actor, PoC or network infrastructure is stated in any source, so the IOC list below contains only the organizations, regulatory bodies and behavioral techniques that are relevant to defenders; it has no malicious infrastructure indicators.

In a media briefing reported by the Free Press Journal (updated 2026-11-12), K7 CyberSecurity argued that ransomware which renders personal data inaccessible may count as a personal data breach under India's Digital Personal Data Protection (DPDP) framework even when no data is exfiltrated. K7 states that the framework has no minimum breach-size exemption once an incident meets the statutory definition. Affected individuals and the Data Protection Board must be notified 'without delay', and a detailed report is due within 72 hours of the data fiduciary becoming aware of the breach unless an extension is permitted. K7 also describes penalties of up to INR 250 crore for failures involving reasonable security safeguards and up to INR 200 crore for breach-notification violations, and stresses that penalties are not automatic.

Timeline: the DPDP Rules, 2025 were notified in November 2025 (sources give 13 or 14 November). Consent Manager registration begins 2026-11-13, which K7 says is not the general enterprise compliance deadline. The major privacy, cybersecurity and breach-notification obligations take effect on 2027-05-13 (18 months after notification for Rules 3, 5-16, 22 and 23 per SCC Online). Independent legal summaries agree on the core Rule 7 mechanics (initial intimation without delay; detailed particulars within 72 hours, extendable by the Board on written request) but differ in wording: one summary describes Board notification 'within hours', and another notes the notification format is not prescribed. Verify against the Gazette text before relying on the exact 72-hour mechanics.

Defensive relevance: K7 recommends maintaining reliable evidence of data access, security controls and incident investigations, and integrating endpoint protection, cloud monitoring, privileged access management and SOC capabilities. It also advises assessing how AI systems process sensitive information, since security monitoring data can contain personal information. Rule 6 of the DPDP Rules (per SCC Online) requires reasonable safeguards including encryption, tokenisation, access controls, logging, audits, and backup and recovery, covering confidentiality, integrity and availability. Incident response playbooks for ransomware in India should therefore include a regulatory-notification decision step that does not depend on proof of exfiltration. MITRE mappings are analyst mappings: T1486 reflects the ransomware impact K7 discusses; the other techniques correspond to the control areas K7 recommends (endpoint protection, privileged access management) and typical ransomware lifecycle stages, and are not stated in the source.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1078 Valid Accounts

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

  • Add a regulatory-notification decision step to ransomware incident response that does not depend on proof of data exfiltration
  • Identify who inside the organization decides, and how quickly, when the Data Protection Board and affected individuals must be notified

Longer-term hardening

  • Maintain reliable evidence of data access, security controls and incident investigations
  • Integrate endpoint protection, cloud monitoring, privileged access management and SOC capabilities
  • Assess how AI systems process sensitive information, since security monitoring data may contain personal information, and keep appropriate oversight

Affected and fixed versions

  • N/A — Data fiduciaries processing personal data of individuals in India

Timeline

  • The Data Protection Board is established with effect from notification, as a MeitY subordinate office with four members (per legal summaries).
  • MeitY notifies the Digital Personal Data Protection Rules, 2025 (most sources give 13 November 2025; one gives 14 November). Rules 1, 2 and 17-21 take effect on publication.
  • Free Press Journal reports K7 CyberSecurity's media briefing: ransomware that makes personal data inaccessible may be a reportable personal data breach even without data theft.
  • Consent Manager registration begins; K7 states this is not the general enterprise compliance deadline.
  • Rule 6 security safeguards (encryption, tokenisation, access controls, logging, audits, backup and recovery; logs retained at least one year per Legal500 summary) become enforceable, covering confidentiality, integrity and availability.
  • Major privacy, cybersecurity and breach-notification obligations (including Rules 3, 6 and 7) take effect, 18 months after notification.

Sources cited

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats