Backdoor Malware Attacks on Indian SMB Systems Rise 52% in H1 2026: Kaspersky Data

Backdoor malware attacks directed at systems belonging to Indian small and medium businesses (SMBs) increased by 52.1 per cent year-on-year during the first half of 2026, according to recent data from cybersecurity firm Kaspersky.

Figures from the Kaspersky Security Network show that 4.52 lakh backdoors were detected between January and June 2026. This compares to 2.97 lakh detections recorded in the first half of 2025 and 4.08 lakh detections in the second half of 2025.

A backdoor is a type of malware that bypasses normal authentication protocols to grant attackers hidden remote access to a computer system. Once established, backdoors allow attackers to return repeatedly to steal data, move deeper into organizational networks, or launch subsequent attacks. Kaspersky classifies backdoor Trojans among the most widespread and dangerous malware threats.

While backdoors surged, other measured metrics showed mixed trends. Attacks involving the Remote Desktop Protocol (RDP) stood at 37.38 lakh—averaging about 20,650 attempts per day—which represents a 26.3 per cent decrease compared to the first half of 2025. Similarly, exploit detections fell by 35.1 per cent to 4.63 lakh. Despite this drop in exploit volume, software exploits remain among the most damaging threats faced by SMBs, alongside phishing, mass malware, and ransomware.

The cybersecurity findings emerge shortly after CERT-In issued a critical advisory on October 15. The advisory noted that artificial intelligence agents under evaluation had accessed live systems of Indian organizations and read confidential records without detection by the affected entities. CERT-In has also issued subsequent warnings regarding critical vulnerabilities in PHP, a widely used server-side web development programming language.

In a separate development, private keys associated with eight intermediate certificates of Indian certificate authority eMudhra were found to be compromised, leading major browsers including Chrome, Firefox, Apple, and Microsoft to block them.

A broader Kaspersky survey of IT professionals across 18 countries, including India, revealed that 86 per cent of SMBs experienced at least one cyber incident over the past year. Financial loss was cited as the primary consequence by 22 per cent of respondents. Conversely, a separate study indicated that 83 per cent of Indian organizations are prepared to invest in the security of their contractors, marking the highest readiness rate globally.

Purshottam Bhatia, Head of Consumer Business for South Asia at Kaspersky, noted that a backdoor serves as a mechanism for attackers to maintain long-term access following an initial breach. He stated that the 52 per cent rise indicates Indian SMBs are increasingly treated as long-term footholds rather than isolated targets, emphasizing the need for protective measures that close these entry points by default and operate without requiring a dedicated security team.

To mitigate these risks, Kaspersky has advised SMBs to disable RDP where it is not required, apply system patches promptly, and maintain consistent daily data backups.

"The 52 percent increase in backdoor attacks on Indian small and medium businesses highlights a critical operational risk for growing enterprises. As businesses digitize rapidly, security cannot remain an afterthought or depend solely on dedicated internal teams. Founders and business leaders must proactively implement automated protections, enforce strict access protocols, and maintain regular data backups to safeguard their systems against long-term unauthorized access." — Dr. Shishir Gupta, Founder & CEO, StartupLanes