Rival Cyber Operations Target Pakistani Law Enforcement
In a concerning development for global cybersecurity, an analysis from SentinelLabs, the research division of SentinelOne, revealed that two competing nation-state cyber espionage operations have focused their efforts on a single Pakistani police force. This dual intrusion is reportedly linked to actors from both China and India, and it took place between February 2024 and April 2026, targeting the Balochistan Police, the main law enforcement agency in the province.
The compromised systems included critical servers that hosted essential applications for managing biometric records, criminal case files, and landlord-tenant registrations connected to national identity data. Notably, a China-associated actor employed malicious implants in a portal utilized by both police officers and members of the public. This breach raises significant concerns regarding the safety and security of sensitive information within Pakistan’s law enforcement framework.
SentinelLabs identified four distinct clusters of command and control (C2) activity linked to these cyber incursions. Evidence points to the use of malware variants such as PlugX, ShadowPad, and Cobalt Strike associated with the Chinese actors, while a Remcos cluster is tied to an India-associated entity known as TAG-179 according to Recorded Future. This overlaps with another group referred to as “Bitter,” illustrating a complex web of cyber threats.
Divergent Motives Behind Cyber Intrusions
The motivations behind these cyber operations stem from the distinct geopolitical interests of the countries involved. The analysis from SentinelLabs suggests that China’s espionage activities are likely driven by concerns over the safety of its nationals, particularly linked to the China-Pakistan Economic Corridor (CPEC). This corridor has seen repeated attacks attributed to the Balochistan Liberation Army (BLA), a militant group advocating for Baloch separatism. In this context, police data could offer crucial insights for China, enabling it to independently assess potential threats to its citizens.
On the other hand, India’s involvement appears to be rooted in its long-standing rivalry with Pakistan, where Balochistan frequently serves as a point of contention. The Pakistani government has accused India of supporting insurgent groups within the province, allegations that India has categorically denied. Control over police records from Balochistan could provide India with an advantage in its intelligence-gathering efforts and strategic planning.
Exploitation of the Complaint Management System
One of the most alarming discoveries from the analysis was the compromise of the Pakistani police force’s Complaint Management System (CMS). This system serves a dual purpose, allowing both officers and citizens to file and track complaints. In late 2024, two different variants of a malware implant named cms_plugin.exe were detected, one developed in Rust and the other in .NET. The Rust variant worked as a stager that, once executed, displayed the message "Update Complete! Please refresh the page," cleverly simulating a legitimate portal update.
The .NET version masqueraded as a component of security software produced by the Chinese vendor Qihoo 360, ultimately loading an AsyncRAT client. Technical analysis revealed shared code and simplified Chinese strings, indicating a connection to a developer who speaks Chinese, further suggesting a sophisticated level of planning involved in the cyber operation.
Access to the databases associated with these applications could yield an extensive array of sensitive information, including:
- Police personnel and payroll records
- Criminal case files and related biometric data
- Records of stolen vehicles
- Hotel check-in information tied to identity data
- Landlord and tenant registrations
- Complaints lodged by citizens, including misconduct allegations against law enforcement officers
The convergence of these cyber operations underscores a significant structural risk in digital policing. Systems designed to centralize records and services also create a concentrated target for foreign adversaries. This scenario positions police infrastructure as critical intelligence territory, with highly valuable information that could be exploited by adversarial nations.
As countries become increasingly reliant on digital platforms for law enforcement and public safety, the necessity for robust cybersecurity measures has never been more crucial. This incident serves as a stark reminder of the complex geopolitical dynamics at play in the 21st century, where cyber operations can have wide-ranging implications for national security and public safety. The unfolding situation in Pakistan calls for heightened vigilance and cooperation among nations to secure their respective digital landscapes from such invasive operations.