XcellSecure|Malware
Stop it on arrival. Kill it on execution. Recover in hours, not weeks.
Today's malware steals passwords, opens the door for ransomware and, on the plant floor, rides in on a USB stick. We block what we can, catch the rest by behaviour, and keep a clean copy of everything you need to restore.
It's rarely a virus that wrecks your files. It's a business model.
Modern malware is sold as a service and built in stages. A small first file gets in, checks the machine, steals what it can and fetches the next tool. Each family below wants something different — and is stopped by a different control.
Empty browser-saved passwords, cookies and crypto wallets in seconds, then sell them. Stolen session cookies can skip MFA.
T1555.003 · T1539Arrive as an invoice, a fake browser update or a cracked tool, then download whatever the buyer of that access wants next.
T1204.002 · T1105Give an operator a live keyboard on your PC: screenshots, keylogging, file transfer — often disguised as remote-support software.
T1056.001 · T1071.001The last stage, usually days after a loader or stolen login: steal data, delete backups, encrypt. See Ransomware.
T1486 · T1490Quietly burn your servers' and cloud VMs' CPU and GPU. The bill — or the slow ERP — is often the first sign.
T1496Spreads on USB sticks and engineering project files, and can change controller logic. Rare, but the impact is physical.
T0847 · T0873 · T0889Top initial attack vectors in IBM's India study. Phishing and drive-by downloads are the two most common ways malware is delivered.
IBM Cost of a Data Breach · India · 3 Aug 2026A malware infection, phase by phase. With the control at each step.
Pick a phase. Every technique ID links to its MITRE page; the right-hand column is what breaks it.
IDs from attack.mitre.org — Enterprise v20 and ICS matrices, checked 10 November 2026. Descriptions are XcellHost's defensive summaries, not MITRE text, and not a coverage score.
Malware in India, by the official numbers.
Government figures first, then the global studies most cited by Indian boards. Each with its date.
cyber incidents handled in 2025, with 1,530 alerts, 65 advisories and 390 vulnerability notes issued.
Lost money to a malware-driven fraud? Call 1930 or report at cybercrime.gov.in (Indian Cyber Crime Coordination Centre) as fast as possible — and tell your bank. Infected device flagged by your ISP? Cyber Swachhta Kendra offers free removal tools at csk.gov.in.
Malware is quiet on purpose. These are the tells.
What users notice on the left; what our SOC sees on the right. If you spot any of these, isolate the device from the network — don't switch it off.
What users notice
- Security tool turned off, or "managed by your organisation" settings changed
- Browser homepage, extensions or search engine changed on their own
- Logged out of every site at once, or MFA prompts they didn't start
- Fans racing and the PC slow while idle
- An "invoice" or "update" opened and nothing seemed to happen
What the SOC sees
- Office or a browser spawning PowerShell, wscript or rundll32
- New run keys, services or scheduled tasks for unsigned files
- Regular beacons to new domains — see our NDR beacon demo
- A process reading the browser's password and cookie stores
- Sign-ins from a new country minutes after a cookie theft — UEBA
Ten questions. Your malware readiness score and the gaps to close first.
Answer honestly — "partly" is fine. Scoring: yes = full points, partly = half, no = none, weighted by how much each control reduces real-world infections.
Prevent, detect, respond, recover. Malware has to beat all four.
Each band lists the controls that matter, linked to the XcellHost service that runs them.
On the plant floor, you can't just reboot. So prevention looks different.
Controllers can't run EDR, many HMIs run old Windows, and patching waits for a shutdown. Malware usually arrives on a USB stick, a vendor laptop or a remote-access tool — so that's where we put the controls.
A kiosk in the DMZ scans media; engineering workstations accept only media marked clean. ATT&CK for ICS: T0847.
On HMIs and engineering stations only approved executables run — no signature updates needed, safe for old Windows.
Hash and back up PLC programs and project files so tampering (T0873, T0889) is spotted and reversible. Acronis for OT*
Passive OT monitoring sends logs one-way to the SOC; nothing scans controllers. Start with an OT assessment aligned to IEC 62443.
What would one outbreak cost you? Your numbers, our arithmetic.
Lost staff time + lost revenue + rebuild effort + incident response — first as things are, then with layered controls that contain early and restore fast. Every input is yours to change.
Formula: staff × cost/h × downtime + revenue/h × downtime + devices × rebuild h × IT cost/h + response. Response cost is assumed equal in both cases. Not a forecast; for scale, IBM's 2026 India average for a full data breach is ₹25.5 crore. Protect bundle compared at 150 users × ₹597/month.
A 90-day plan that closes the doors malware uses most.
Front-loaded with changes that remove whole classes of infection for little cost.
Close the front doors
- EDR on every PC and server, tamper protection on, block mode
- Attachment sandboxing and link checks on all mailboxes
- Block internet macros; block script files at the mail gateway
- One immutable or offline backup copy; one test restore
Shrink what can run
- Third-party app patching: browsers, PDF, Java, VPN clients
- Remove local admin rights; app control on high-risk roles
- USB policy: block storage, allow approved devices
- Turn off browser password saving; move to a managed vault
Watch and rehearse
- 24×7 SOC with isolation rights on every device
- OT allow-listing and a USB kiosk at each plant
- Breach & attack simulation to prove detections
- Phishing simulation and a tabletop with leadership
Built from services you can buy one at a time.
Every control on this page maps to an existing XcellHost service. We integrate them into one SOC view and one INR invoice.
| Layer | Stops | XcellHost services |
|---|---|---|
| Endpoint | Execution, persistence, credential theft | Microsoft Defender · Scrutiny EDR · SentinelOne* · Acronis* · Kaspersky* |
| Attachments, links, impersonation | Email Security SMB · Advanced Email Security · DMARC · Phishing simulation | |
| Hygiene | Exploited vulnerabilities, risky apps | Patch management · Managed Intune · Security posture |
| Network | Downloads, C2, spread | NDR · Fortinet* · Palo Alto Networks* · Managed SD-WAN |
| SOC | Anything that gets past | Security Operations · NG-SIEM · Case Management · Managed Sentinel |
| Recovery | Encryption, wipers, corruption | Veeam* · Commvault* · Cloud DR · Ransomware warranty* · Certified disk erasure |
| OT | USB and project-file malware | OT Assessment · Acronis for OT* · IoT cloud · IoT PKI · Smart manufacturing |
* Partner or third-party products, trademarks of their owners. XcellHost is a Microsoft Gold Partner.
Malicious code is named in the rules. Here's what each one asks.
Compliance remains your responsibility; our services produce the evidence.
Malicious code attacks, including ransomware, are reportable within 6 hours of noticing. Keep ICT logs for 180 days in India — EDR and email logs included.
An infostealer that takes customer or staff data is a personal data breach: notify the Data Protection Board and affected people; detailed report to the Board within 72 hours. DPDP platform →
Regulated entities are expected to run anti-malware, patch management and continuous monitoring, with tested backup and recovery.
"Protection against malware" is its own control, supported by user awareness; our monthly reports document it for auditors.
Zones, conduits, removable-media control and OT backups — evidence from an OT assessment.
Test your defences, close the gaps, or hand us the watch.
Each bundle is a sum of existing XcellHost services at their published prices. Indicative, excl. 18% GST; Microsoft licences billed separately.
- BAS Readiness Assessment₹49,999
- Microsoft 365 tenant health check₹14,999
Safe malware simulations against your EDR, email and web controls, plus a mail-tenant review. Gap report and 90-day plan.
- Managed Defender Essential₹199
- Patching · OS + third-party₹199
- Email Security SMB Business₹199
Blocks most delivery and execution paths, with 24×7 EDR alert triage.
- Managed Defender Professional₹449
- Patching · OS + third-party₹199
- Advanced Email · Protect + Respond₹299
- Acronis Essentials backup₹349
Adds containment and remediation, post-delivery email clean-up and backup you can restore from.
Component prices as published on Breach & Attack Simulation, Advanced Email Security, Microsoft Defender, Patch management, Email Security SMB and Acronis — indicative, excl. 18% GST. Email prices are billed annually on those pages. Defender for Business licence (₹250/user/month, Microsoft list price) is separate.
Build your bundle. See the first invoice.
Users, devices, servers and add-ons. First invoice = one-time items plus the first month.
Malware · Protect
All prices as on the linked XcellHost pages — indicative, excl. 18% GST in the lines above. Microsoft and partner licences quoted separately.
Malware, answered.
Not on its own. Signature antivirus catches known files; modern malware changes constantly and often uses built-in tools like PowerShell. EDR watches behaviour — an attachment launching a script that contacts a new domain — and can kill the whole process tree and isolate the device. Patching, email sandboxing and app control stop much of it before EDR is needed.
An infostealer copies saved passwords, browser cookies and wallet files, then sends them to criminals who sell them. Stolen session cookies can let someone sign in without your password or MFA. Verizon's 2026 DBIR found that half of ransomware victims had an infostealer credential leak in the 95 days before the attack. Turn off browser password saving, use phishing-resistant MFA and revoke sessions after any infection.
Isolate the device from the network (EDR isolation or unplug the cable) but don't switch it off; reset the user's passwords from a clean device and revoke their sessions; call your SOC. Then decide CERT-In reportability — malicious code attacks must be reported within 6 hours of noticing. Our first-60-minutes playbook walks through the steps.
Yes. Servers hold the data and are where ransomware is deployed from. Defender for Business covers servers with an add-on licence, and our server patching runs at ₹699 per server per month, indicative, excluding GST. Back them up with an immutable copy as well.
With controls that don't need modern operating systems: application allow-listing, a USB scanning kiosk, network separation through an IT/OT DMZ, passive monitoring and backups of project files. Nothing scans controllers actively. An OT assessment maps what's safe to deploy at your site.
Only if malware can't reach them. Keep at least one immutable or offline copy with separate credentials, scan backups before restoring, and test a restore every quarter. Acronis Essentials through XcellHost starts at ₹349 per workstation per month, indicative, excluding GST.
CERT-In's 28 April 2022 directions list "attacks or malicious code" — including ransomware, viruses, worms and trojans — among incidents to report within 6 hours of noticing. Whether a single, contained infection on one laptop meets the bar is a judgement for your nodal officer; we prepare the facts and evidence.
Cyber Swachhta Kendra is CERT-In's botnet cleaning and malware analysis centre. It works with internet providers to notify owners of infected systems and offers free malware-removal tools — 89.55 lakh downloads by December 2025, per PIB. It complements, but doesn't replace, managed endpoint protection for a business.
No. Bundle prices are sums of the indicative component prices published on the linked XcellHost pages, excluding 18% GST and Microsoft or partner licences. You get a written INR quotation after a scoping call.