What to do if I suspect I am part of a ransomware scam?

Immediately stop all communications with the scammers and report the incident to the cybercrime helpline at 1930. Visit cybercrime.gov.in for further guidance.

How can I identify a Telegram 'Partner' Recruitment for RaaS scam?

Look for unsolicited invites promising easy money, unrealistic earning claims, and guides for deploying malware. Always do your research before proceeding.

How do I report a ransomware attack in India?

You can report the ransomware attack by contacting 1930, visiting cybercrime.gov.in, and notifying your bank immediately about any suspicious activities.

Can I recover money lost in a ransomware scam?

Recovering money is challenging but notify your bank instantly if you suspect fraud. They may assist in securing your account and warn other clients.

Telegram ‘Partner’ Recruitment for RaaS

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Verdict: Suspicious | Risk Score: 8/10 | Severity: high

Category: WhatsApp, Job, Phishing

How Telegram ‘Partner’ Recruitment for RaaS Works

Overview: This scam involves ransomware operators recruiting Indian cybercriminals via Telegram channels, advertising high earnings for joining as ‘partners’ or ‘affiliates.’ These criminals then carry out ransomware attacks using leased malware tools. The scam is perilous for society as it swiftly amplifies the number of malicious actors without much technical background, posing a risk to businesses and individuals nationwide. How It Works: Operators run Telegram channels in regional Indian languages, posting offers like, “Earn lakhs weekly joining our affiliate partner program!” Interested users are quickly onboarded, given simple tutorials, and provided kits for deploying ransomware. They are promised a generous share of any ransom collected. Victims are typically targeted through phishing or compromised accounts, and the affiliates perform onslaughts guided by playbooks from the operators. India Angle: These schemes now openly target Indians on Telegram and even WhatsApp, exploiting the platform’s popularity among youth. The recruitment pitch is often in ‘Hinglish’ (Hindi-English mix) and mentions Indian festivals like Holi or Diwali bonuses for affiliates. Young men aged 18–30 in metros like Mumbai and Bangalore are frequently targeted as potential criminal partners, incentivizing them with quick, anonymous payouts via crypto. Real Examples: Sample Telegram pitch: “Join exclusive partner program! Setup in 1 hour. Diwali bonus for top performer! DM now, no experience needed.” Victimization: After a university student joined, he deployed ransomware at his friend’s workplace, lured by the promise of a 30% ‘partner’ cut if the ransom was paid. Red Flags: - Unsolicited Telegram messages advertising partner programs. - Guarantees of fast, high earnings for simple online tasks. - Tutorials teaching how to install or spread malware. - Pitches mentioning Indian holidays as bonus periods. Protective Measures: - Ignore and block unknown Telegram recruiters or job offers. - Never accept software, scripts, or ‘toolkits’ from strangers. - Inform police or cybercrime helpline if approached about illegal activities. - Educate students and young professionals about legal consequences. If Victimised: - If you or someone you know gets involved, immediately disengage and retain evidence. - Call the national cybercrime helpline (1930) to report the approach. - Seek legal guidance to minimize exposure to criminal liability. Related Scams: - WhatsApp job scams requiring shady online ‘tasks’. - Deepfake-based criminal recruitment pitches.

How This Scam Works — Detailed Explanation

Scammers operating in the realm of ransomware-as-a-service (RaaS) have found a new avenue to recruit unsuspecting individuals through popular social media platforms, particularly Telegram. These operators create enticing Telegram channels that promise substantial earnings for individuals willing to work as 'partners' or 'affiliates' in carrying out ransomware attacks. These channels are often advertised in regional languages to reach a broader audience across India, tapping into local sentiments and exploiting the cultural context. By sending out unsolicited invites and enticing advertisements, they draw in people who may not have any prior technical expertise but are looking for quick money, particularly during festive seasons when financial tensions run high.

To manipulate their targets effectively, scammers utilize a range of psychological tactics designed to prey on individuals' desires for financial gain and the allure of easy money. They may depict success stories, showing off high earnings achieved by current associates, which leads victims to believe that significant wealth is easily attainable. Furthermore, these scam operations often emphasize that no technical skills are required, further lowering barriers for entry. They also exploit local festivals to boost recruitment, framing their operations as an opportunity to earn extra cash during times of increased expenditure, making the offer seem even more appealing for many.

Once individuals are lured into these schemes, they are instructed to engage with malicious software tools that can execute ransomware attacks. The recruitment process generally involves a series of onboarding steps, during which individuals are taught how to spread malware in exchange for a share of any extorted ransom. Victims may find themselves collaborating with these criminals, inadvertently causing harm to organizations and individuals across India. Real-world examples show victims losing millions; for instance, ransomware attacks last year alone led to losses exceeding ₹300 crores, affecting major banks and SMEs that often depend on digital payments like UPI and Aadhaar for transactions.

The broader societal impact of this scam is troubling. The rise in ransomware attacks complicates the already strained cybersecurity landscape in India. Institutions like the Ministry of Home Affairs, Reserve Bank of India, and CERT-In have issued guidelines advising citizens to remain vigilant and report any suspicious activities. In 2023 alone, cybercrime reports indicated that over ₹1,000 crores were lost to various online frauds, with ransomware being one of the top offenders. This highlights the urgent need for increased awareness and swift action from the authorities and the public to combat this burgeoning threat.

Spotting these scams can often be challenging for the average Indian online user. Legitimate business communications typically do not promise unrealistic earning potential for minimal input and would never solicit individuals through unsolicited messages on social platforms like Telegram. Additionally, be wary of unsolicited ‘partner program’ invites, particularly during festive seasons, or any promotions that promise immediate wealth. Always verify the legitimacy of the source before proceeding or sharing personal information to avoid falling victim to deceptive practices.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Telegram ‘Partner’ Recruitment for RaaS Target?

General public across India

Red Flags — How to Identify Telegram ‘Partner’ Recruitment for RaaS

Unsolicited ‘partner program’ invites on Telegram
Unrealistic earning potential for minimal work
Guides for deploying malware targeting India
Recruitment timed to Indian festivals

What To Do If You Encounter Telegram ‘Partner’ Recruitment for RaaS

Report any suspicious Telegram communications to the cybercrime helpline at 1930 or visit cybercrime.gov.in.
Avoid engaging with unsolicited invites for partner programs on Telegram or any other platform.
Educate yourself about ransomware threats and their mechanisms through trusted cybersecurity resources.
Secure your personal information: Do not share sensitive data or financial information through unauthorized channels.
Regularly update your passwords and enable two-factor authentication on your online accounts to enhance security.
If you suspect you may have been engaged in such activities, seek legal advice and inform your bank immediately.

How to Report Telegram ‘Partner’ Recruitment for RaaS in India

Call 1930 — National Cyber Crime Helpline (24x7)
File a complaint at cybercrime.gov.in
Contact your bank immediately if money was lost
Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I suspect I am part of a ransomware scam?: Immediately stop all communications with the scammers and report the incident to the cybercrime helpline at 1930. Visit cybercrime.gov.in for further guidance.
How can I identify a Telegram 'Partner' Recruitment for RaaS scam?: Look for unsolicited invites promising easy money, unrealistic earning claims, and guides for deploying malware. Always do your research before proceeding.
How do I report a ransomware attack in India?: You can report the ransomware attack by contacting 1930, visiting cybercrime.gov.in, and notifying your bank immediately about any suspicious activities.
Can I recover money lost in a ransomware scam?: Recovering money is challenging but notify your bank instantly if you suspect fraud. They may assist in securing your account and warn other clients.

Related Scams in India

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.