Loading story…
Multiple Pakistani law enforcement organizations were subjected to sustained cyberespionage intrusions between February 2024 and April 2026, with Balochistan Police identified as the most heavily targeted victim. SentinelLABS reported that suspected China-linked and India-linked operators used tools and infrastructure including PlugX, ShadowPad, Cobalt Strike, and Remcos to compromise police web servers, network appliances, and a Fortinet FortiMail appliance, gaining access to environments that handled highly sensitive operational and personal data.
A suspected China-linked actor also compromised the Balochistan Police Complaint Management System (CMS) and used the public-facing portal to host malware implants, effectively turning a citizen service into a malware delivery channel. The affected systems contained biometric records, criminal case files, hotel and tenant registrations, personnel records, and citizen complaints, creating surveillance and exposure risks for both police staff and members of the public; researchers assessed the likely objectives as intelligence collection on threats to Chinese nationals in Pakistan and on Pakistan’s security posture in Balochistan.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers said the compromised infrastructure in the espionage campaign was associated with Khyber Pakhtunkhwa Police, Islamabad Police, and the Punjab Safe Cities Authority, in addition to Balochistan Police. The affected systems hosted web applications managing sensitive police and citizen data, including criminal records, biometric data, registrations, and personnel files.
The intrusions against Pakistani law enforcement organizations continued through April 2026, involving suspected China-nexus and India-nexus actors. The activity used PlugX, ShadowPad, Cobalt Strike, and Remcos against police web servers, network appliances, and a Fortinet FortiMail appliance.
A suspected China-nexus actor compromised the Balochistan Police Complaint Management System and hosted malware implants on the portal. This turned a police-and-citizen service into a malware delivery mechanism that could expose police personnel and citizens to infection and surveillance.
SentinelLABS reported that sustained cyberespionage intrusions targeting multiple Pakistani law enforcement organizations began in February 2024. Balochistan Police was identified as the most heavily targeted victim.
In late 2024, attackers uploaded two cms_plugin.exe variants to the Balochistan Police Complaint Management System: a Rust-based stager and a .NET implant masquerading as Qihoo 360 software that loaded an AsyncRAT client. SentinelLabs said shared code and simplified Chinese strings suggested a Chinese-speaking developer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceinfosecurity-magazine.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcetherecord.media
Open sourcecommunity.gurucul.com
Open sourcemalware.news
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked threat activity was reported against both critical infrastructure in India and diplomatic targets in Europe, with researchers describing sustained espionage and pre-positioning operations rather than confirmed destructive attacks. Recorded Future’s Insikt Group said intrusions hit seven Indian State Load Dispatch Centers near the disputed Ladakh border, as well as India’s national emergency response apparatus and an Indian logistics subsidiary, using **ShadowPad** malware, compromised DVR/IP camera devices for command-and-control, and the **FastReverseProxy** tool. The activity was assessed as likely intended to establish access and collect intelligence inside India’s power sector. Separately, Proofpoint said China-aligned actor **TA416** increased operations against European diplomatic entities as Russia-Ukraine tensions escalated, including targeting a person involved in refugee and migrant services. The campaigns used web bugs to confirm active recipients before sending malicious links that ultimately deployed updated **PlugX** malware through ZIP archives, droppers, and DLL search-order hijacking. Proofpoint found substantial overlap between TA416 and the publicly reported **Red Delta** cluster, while Beijing publicly denied involvement in the India-related accusations and said it opposes cyberattacks.
Aug 15, 2026
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026
Arctic Wolf reported an **India-nexus espionage campaign** attributed to **SloppyLemming** (aka *Outrider Tiger* / *Fishing Elephant*) targeting government entities and critical infrastructure operators in **Pakistan and Bangladesh** (with additional reporting noting **Sri Lanka**). The activity, tracked from **January 2025 to January 2026**, used two main infection chains: (1) **PDF lure documents** that redirected victims to **ClickOnce** manifests, deploying a **DLL sideloading** package using a legitimate `.NET` runtime executable (`NGenTask.exe`) alongside a malicious loader (`mscorsvc.dll`) that decrypted and executed a custom x64 shellcode implant dubbed **BurrowShell**; and (2) **macro-enabled Excel** lures delivering a **Rust-based** keylogger/recon tool with capabilities including port scanning and network enumeration. BurrowShell was described as a full-featured backdoor enabling file operations, screenshot capture, remote shell execution, and **SOCKS proxy** tunneling, while attempting to blend in by masquerading C2 as **Windows Update** traffic and using **RC4** with a 32-character key for payload protection. Infrastructure analysis tied the campaign to **112 Cloudflare Workers domains** registered during the tracking period—an expansion in scale compared to prior public reporting—and included government-themed domain naming intended to increase victim trust. Reported targets included Pakistani nuclear regulatory and defense-adjacent organizations (e.g., the **Pakistan Nuclear Regulatory Authority**, **Pakistan Navy**, and logistics/telecom entities) and Bangladeshi energy and financial-sector organizations (including power grid/utility operators). Arctic Wolf assessed the actor as moderately capable, citing multi-stage execution and defense evasion knowledge alongside operational security lapses (e.g., exposed directories), and noted the activity as an expansion of threat activity previously identified publicly by Cloudflare.
Jun 29, 2026