As geopolitical tensions flare between India and Pakistan following Operation Sindoor—the largest Indian cross-border strike since 1971—a parallel conflict is intensifying in cyberspace. Hacktivist groups aligned along political, religious, and nationalist lines are launching a wave of distributed denial-of-service (DDoS) attacks and cyber disruption campaigns, amplifying a crisis already teetering on the edge.
According to cybersecurity firm Radware, the hours following India’s missile strikes on May 7 saw a dramatic spike in hacktivist activity. These attacks—primarily targeting Indian government websites and critical infrastructure—coincided with a sharp escalation of artillery fire along the Line of Control and a surge in nationalistic fervour online.
Operation Sindoor and Cyber Retaliation
The military operation, launched in response to the April 22 massacre of Indian civilians in Pahalgam, Kashmir, triggered an immediate digital backlash. Hacktivist groups, many based in Bangladesh and Pakistan, began launching coordinated DDoS attacks within hours. By 9:30pm IST on May 7, Radware recorded a peak of seven claimed attacks per hour, with government portals, financial institutions, and telecoms bearing the brunt.
India responded swiftly, temporarily blocking overseas access to its National Stock Exchange and Bombay Stock Exchange websites. While officials insist that trading systems remain unaffected, the preemptive move underscores the perceived cyber risk posed by state-aligned and freelance hacktivists alike.
Hacktivist Alliances Form Across Borders
Radware’s threat intelligence reveals a growing convergence among hacktivist groups. Actors such as RipperSec, AnonSec, Keymous+, and Sylhet Gang—responsible for over 60% of DDoS activity against India in 2025—are no longer operating in silos. These groups are now forming loose federations, unified by shared ideologies and enemies.
Recent activity includes support declarations from Vulture, an Iranian threat group traditionally focused on Israeli targets, now pledging solidarity with Pakistan. Such cross-regional coordination signals a troubling evolution: the transformation of ideologically driven cells into global digital militias.
“This isn’t just about India and Pakistan anymore,” a Radware analyst noted. “It’s about the normalisation of coordinated cyber retaliation as a tool of influence and retaliation.”
Application-Layer and Hybrid Attacks on the Rise
Beyond raw traffic floods, attackers are increasingly deploying sophisticated, low-volume application-layer DDoS techniques designed to evade detection. By mimicking legitimate traffic patterns—such as encrypted HTTPS requests and form POSTs—hacktivists can cripple backend systems without triggering traditional alarms.
Compounding the threat are hybrid DDoS campaigns, which merge volumetric floods with surgical application-layer strikes. Such multifaceted attacks challenge even well-prepared defenses, as defenders must address both bandwidth exhaustion and server resource strain in real-time.
One group, RipperSec, reportedly maintains a public DDoS tool known as MegaMedusa, designed for wide-scale deployment by low-skill actors. Its availability on GitHub and minimal setup requirements have made it a go-to weapon for hacktivists looking to participate in so-called “patriotic operations.”
Infrastructure in the Crosshairs
Since January 1, over 100 Indian organisations have been targeted in 256 claimed DDoS attacks by at least 26 threat groups. Government sites are the primary focus, followed by education, finance, manufacturing, and telecom sectors.
The motivation isn’t purely disruption—it’s symbolic. Defacements, data leaks, and takedowns are aimed at eroding public confidence, sowing chaos, and sending geopolitical messages. Many of these attacks are posted and amplified across Telegram and other dark social channels, blurring the line between cyber sabotage and propaganda.
A Cycle of Retaliation
The digital crossfire is not one-sided. Indian-aligned cyber collectives, including Indian Cyber Force and Ghost Force, have launched retaliatory attacks against Pakistani targets. As nationalist fervor spikes, both sides risk entering a cycle of escalating digital retribution, potentially targeting energy grids, health systems, and transportation networks.
With several powerful groups like Mysterious Team Pakistan and RipperSec pledging future action, the cyber landscape remains volatile. “The next phase may not be about website downtime—it could be data manipulation or physical infrastructure disruptions,” warned Radware.
Looking Ahead
As diplomatic channels work to deescalate the military standoff, the cyber conflict shows no signs of cooling. In fact, the border between nation-state interest and activist disruption is becoming increasingly blurred. In this era of hybrid warfare, firepower is no longer limited to missiles—it now travels through cables, keystrokes, and clouds.
India and Pakistan’s latest clash may have reignited a physical conflict, but it is in cyberspace that the real long-term battles—and vulnerabilities—may play out.
