China- and India-Linked Hackers Targeted Pakistani Police Networks, Researchers Say
Summary
SentinelLabs says China- and India-linked groups intruded into Pakistani police networks from February 2024 to April 2026, targeting systems including Balochistan Police databases and planting fake software updates on its complaint portal.
Key points
- SentinelLabs says the intrusions targeted several Pakistani police organizations from February 2024 through April 2026, with Balochistan Police bearing most of the activity.
- Targeted servers were tied to biometric databases, criminal case files, personnel records, and citizen-facing systems.
- Researchers grouped the activity into PlugX, ShadowPad, Cobalt Strike, and Remcos clusters; they cautioned that shared or commodity malware may involve multiple operators.
- Malicious files disguised as software updates were found on Balochistan Police’s public Complaint Management System, potentially reaching officers and other portal users.
- SentinelLabs linked the intrusions to a Chinese-speaking developer based on shared code patterns and artifacts in related malware samples.
- The researchers described possible Chinese and Indian strategic motives, while noting that Pakistan’s accusation of Indian support for Baloch militants has been denied by India.
Article Details
- Event Type
- Cyberespionage intrusions targeting Pakistani police organizations
- Impact
- Attackers reached servers tied to biometric databases, criminal case files, personnel records, and citizen-facing systems, with Balochistan Police bearing most of the reported activity. Malicious files disguised as software updates were planted on Balochistan Police’s public Complaint Management System; the prompt could have affected officers and members of the public using the site.
Malware
PlugXThe researchers grouped the intrusions into four clusters based on the malware and infrastructure involved: PlugX, ShadowPad, Cobalt Strike, and Remcos.RemcosThe researchers grouped the intrusions into four clusters based on the malware and infrastructure involved: PlugX, ShadowPad, Cobalt Strike, and Remcos.ShadowPadThe researchers grouped the intrusions into four clusters based on the malware and infrastructure involved: PlugX, ShadowPad, Cobalt Strike, and Remcos.
Tools
Countries
ChinaNew research from SentinelOne shows that cyberespionage groups linked to both China and India spent more than two years quietly breaking into Pakistani law enforcement networks, with Balochistan Police getting hit fromIndiaNew research from SentinelOne shows that cyberespionage groups linked to both China and India spent more than two years quietly breaking into Pakistani law enforcement networks, with Balochistan Police getting hit fromPakistanSpecifically, Chinese nationals working on Belt and Road projects in Pakistan have been repeatedly targeted in attacks tied to Baloch separatist militants, and Chinese officials have openly criticized Islamabad’s