Offline PCs at Risk: India Faces 64M Local Cyber Attacks in 2025

The conventional wisdom that disconnecting a computer from the internet provides a foolproof shield against cyber threats is being decisively challenged in India. According to recent data from global cybersecurity firm Kaspersky, the year 2025 witnessed a staggering surge in offline cyber attacks, targeting a fundamental assumption of modern digital defense. The statistics are alarming: one in every three PC users in India encountered a local cyber attack, with security software intercepting a monumental 64 million (6.4 crore) such incidents. This trend marks a pivotal evolution in attacker tradecraft, moving beyond the network to exploit the physical attack surface.

The Anatomy of an Offline Attack

Offline, or local, attacks circumvent network security controls by leveraging physical access vectors. The primary culprits are infected removable media devices. A seemingly innocuous USB flash drive, gifted at a conference or found in a parking lot, can harbor malware designed to auto-execute upon connection. External hard drives used for data backups and even smartphones connected for charging or file transfer serve as potent carriers. The malware payloads range from information-stealing trojans and ransomware to sophisticated spyware designed for espionage. Once executed on the target system, they can establish persistence, exfiltrate data to the same removable media for later retrieval, or lie dormant until the machine is connected to a network.

Why India is a Prime Target

Several factors contribute to India's heightened exposure. The country's massive and growing digital user base presents a vast attack surface. The widespread use of removable media for software licensing, data sharing in environments with limited broadband, and software piracy creates fertile ground for infection spread. Furthermore, a significant portion of users, including in government offices, critical infrastructure, and manufacturing (where air-gapped systems are common for operational technology), may operate under a false sense of security due to network isolation. This gap in awareness is precisely what threat actors are exploiting.

Implications for Cybersecurity Strategy

For cybersecurity leaders and professionals, this data is a clarion call to re-evaluate endpoint protection strategies. Relying solely on firewalls, intrusion prevention systems, and web gateways is no longer sufficient. The defense-in-depth model must be reinforced at the endpoint layer with renewed vigor.

1. Enhanced Endpoint Detection and Response (EDR): Solutions must excel at behavioral analysis to detect malicious activity stemming from local execution, not just network traffic. Heuristic analysis and sandboxing for files from removable media are critical.
2. Strict Device Control Policies: Organizations must implement and enforce policies that restrict the use of unauthorized removable media. This can be achieved through Group Policy in Windows environments or third-party device control software that whitelists specific, company-issued hardware.
3. Comprehensive Security Awareness Training: Users are the first line of defense. Training must evolve to cover physical social engineering—the "dropped USB" tactic—and the dangers of connecting unknown devices. The message that "offline does not mean safe" needs to be ingrained.
4. Application Whitelisting: In high-security environments, allowing only pre-approved applications to run can prevent malware from removable media from executing in the first place.
5. Regular Scanning of Removable Media: Mandatory antivirus scans of any connected media before allowing access to the file system can catch known threats.

The Bigger Picture: A Global Shift in Tactics

While the data focuses on India, the tactic is globally relevant. Advanced Persistent Threat (APT) groups have long used USB-based attacks for infiltrating air-gapped networks in sensitive sectors like defense and energy. The commoditization of this technique now brings it to the masses, targeting businesses and individuals for financial gain. It represents a democratization of high-end cyber espionage tools, lowering the barrier to entry for cybercriminals.

The 64 million blocked incidents in India are likely just the tip of the iceberg, representing attacks caught by security software. The true number of successful infections may be significantly higher. This trend underscores that in cybersecurity, the attack surface is holistic, encompassing both the digital and the physical realm. Defenders must broaden their focus accordingly, ensuring that their security posture is resilient not just online, but offline as well. The era where a disconnected computer was a safe computer is officially over.