Chinese and Indian Cyber Espionage Target Pakistani Police
Recent analysis from SentinelLabs indicates that cyber espionage operations attributed to both China and India have converged on the Balochistan Police in Pakistan. Between February 2024 and April 2026, these nation-state actors executed intrusion campaigns against several law enforcement bodies, with a focus on the province's main police force. The compromised systems included servers that manage biometric records, criminal case files, and tenant registrations linked to national identity data. Notably, a China-linked actor reportedly implanted malware in a portal utilized by both officers and citizens.
SentinelLabs categorized the observed command and control activities into four distinct clusters. The presence of malware such as PlugX, ShadowPad, and Cobalt Strike is associated with China-linked operators, while a Remcos cluster is connected to an India-linked actor identified by Recorded Future as TAG-179, which overlaps with a group known as Bitter.
The motivations behind these cyber operations appear to differ. For China, the primary concern seems to be the safety of its nationals, particularly in relation to the China-Pakistan Economic Corridor (CPEC), which has faced threats from groups like the Balochistan Liberation Army (BLA). Access to police data would enable China to independently assess these threats. Conversely, India's interest likely stems from its ongoing rivalry with Pakistan, with Balochistan being a significant point of contention. Islamabad has accused New Delhi of supporting insurgency efforts, a claim that India has denied.
A significant finding from the analysis was the compromise of the police force's Complaint Management System (CMS), which is used by both officers and citizens to check on complaints. In late 2024, two variants of malware named cms_plugin.exe were uploaded to the system, one written in Rust and the other in .NET. The Rust variant acted as a stager, displaying a message that mimicked a portal update, while the .NET variant masqueraded as a component of Qihoo 360's security software, loading an AsyncRAT client. The presence of shared code and simplified Chinese strings suggests involvement from a Chinese-speaking developer.
Access to the databases behind these applications could lead to the exposure of sensitive information, including police personnel and payroll records, criminal case files, fingerprint biometrics, hotel check-ins linked to identity data, and citizen complaints, including reports of misconduct. This situation underscores a critical vulnerability in digital policing: the centralization of records and services not only enhances operational efficiency but also increases the intelligence value of police infrastructure, making it a target for capable adversaries.
