Cyber Espionage Targets Balochistan Police in Multi-Nation Campaign

Cybersecurity researchers have disclosed ongoing cyber espionage activities targeting several Pakistani law enforcement agencies, particularly the Balochistan Police, attributed to suspected threat actors aligned with China and India. This campaign, which took place between February 2024 and April 2026, involved the compromise of critical assets, including servers that manage police and citizen data, such as biometric and criminal records.

Aleksandar Milenkoski, a principal threat researcher at SentinelOne SentinelLABS, reported that the attackers exploited vulnerabilities in network appliances and web applications, including the Complaint Management System (CMS), which serves both police staff and citizens. This breach allowed the deployment of a custom implant disguised as a portal update, significantly increasing the risk to users of the system.

SentinelOne identified compromised infrastructure linked to other Pakistani law enforcement organizations, including the Khyber Pakhtunkhwa Police and the Islamabad Police. Four distinct threat clusters were noted, each utilizing unique malware families: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. The Remcos RAT has been associated with an India-aligned threat actor, while PlugX, ShadowPad, and Cobalt Strike are typically linked to Chinese state-sponsored hacking groups.

The deployment of PlugX and ShadowPad, particularly between February and December 2024, underscores the involvement of Chinese nation-state actors. The victimology associated with these malware families extends beyond Pakistani law enforcement to various sectors, including government, defense, and non-governmental organizations across Asia and the Middle East, indicating a broader espionage strategy.

The Remcos-related intrusion set shares infrastructure with a group known as Mysterious Elephant, which has connections to Indian threat actors. Attack chains have utilized decoy documents related to Pakistani law enforcement, further complicating the threat landscape.

The Cobalt Strike cluster's connections to Chinese threat actors are evidenced by its targeting of diverse entities, including Tibetan Buddhist organizations in Taiwan, which have historically been under surveillance by Chinese cyber operatives.

In examining the Balochistan Police's compromised assets, researchers noted that the CMS, used for managing citizen complaints, was infected with two variants of an implant named "cms_plugin.exe" between June 2024 and April 2026. This incident illustrates the geopolitical complexities of cyber espionage, where both allies and adversaries of Pakistan converge on the same target for intelligence purposes.

Milenkoski emphasized that the simultaneous targeting of a single state's law enforcement institutions by multiple cyber actors signals the high value placed on such institutions. The breach of the CMS not only compromised police operations but also transformed a tool intended to enhance public accountability into a vehicle for malware distribution, raising significant concerns about the security of critical infrastructure in Pakistan.