China, India-Linked Hackers Both Targeted Same Pakistani Police Force
SentinelOne’s SentinelLabs identified a prolonged cyberespionage campaign targeting Pakistani law enforcement networks, specifically the Balochistan Police, involving actors linked to both China and India. The intrusion spanned from February 2024 to April 2026, utilizing four distinct malware clusters: PlugX, ShadowPad, Cobalt Strike, and Remcos, with some clusters potentially operated by multiple threat actors. Attackers compromised sensitive servers containing biometric databases, criminal cas
Analysis
TL;DR
- SentinelOne’s SentinelLabs identified a prolonged cyberespionage campaign targeting Pakistani law enforcement networks, specifically the Balochistan Police, involving actors linked to both China and India.
- The intrusion spanned from February 2024 to April 2026, utilizing four distinct malware clusters: PlugX, ShadowPad, Cobalt Strike, and Remcos, with some clusters potentially operated by multiple threat actors.
- Attackers compromised sensitive servers containing biometric databases, criminal case files, and personnel records, while also planting malicious files disguised as software updates on the public Complaint Management System.
- Chinese-linked actors likely sought independent threat assessment regarding attacks on Belt and Road Initiative personnel, while Indian-linked actors aimed to gather intelligence on Pakistan’s handling of Baloch separatist insurgents.
Why It Matters
This incident highlights the intersection of geopolitical rivalry and critical infrastructure security, demonstrating how state-sponsored cyberespionage targets law enforcement agencies to gain strategic intelligence on regional conflicts. For AI and cybersecurity practitioners, it underscores the sophistication of supply chain and web-based attack vectors, such as compromised public-facing portals, and the necessity of robust monitoring for anomalous malware clusters like PlugX and ShadowPad.
Technical Details
- Malware Infrastructure: The campaign utilized four primary malware families: PlugX, ShadowPad, Cobalt Strike, and Remcos. Researchers noted that while Remcos was tied to a single tracked actor, the other clusters used shared or commodity malware, suggesting potential collaboration or multiple operators within those groups.
- Targeted Systems: Intrusions reached high-value data repositories including biometric databases, criminal case files, and citizen-facing systems. A specific vector involved malicious files disguised as software updates embedded directly into the Balochistan Police’s public Complaint Management System.
- Attribution Clues: SentinelLabs linked Chinese-speaking developers to the intrusion through shared code patterns and artifacts in the malware samples. The timeline of the breach was reported as running from February 2024 through April 2026.
- Scope of Impact: The attacks primarily affected the Balochistan Police but extended to other Pakistani law enforcement organizations, indicating a broad effort to infiltrate regional security structures.
Industry Insight
- Geopolitical Cyber Espionage: Organizations in geopolitically sensitive regions should anticipate being caught in the crossfire of rival state actors. Security strategies must account for multi-vector threats where different nations target the same infrastructure for divergent strategic goals.
- Supply Chain and Web Vulnerabilities: The use of fake software updates on public portals demonstrates the risk of compromising trusted interfaces. Regular integrity checks of public-facing applications and strict validation of update mechanisms are essential to prevent such injections.
- Malware Cluster Analysis: The presence of multiple malware families suggests a complex threat landscape. Security teams should implement behavioral detection rather than relying solely on signature-based alerts, especially when dealing with commodity tools like Cobalt Strike and PlugX that can be easily modified.
Disclaimer: The above content is generated by AI and is for reference only.