KARACHI: Suspected state-sponsored hackers from China and India separately infiltrated several Pakistani law enforcement organisations in unrelated cyber-espionage campaigns between February 2024 and April 2026, according to a new report by cyber security firm SentinelOne’s threat intelligence division, SentinelLabs.
The report said threat actors linked to both countries converged on the Balochistan Police over the two-year period, compromising network appliances and web servers hosting applications that manage biometric data, criminal case files, hotel and tenant registrations linked to national identity records, and personnel files.
Besides Balochistan Police, the researchers said they found compromised infrastructure tied to three other Pakistani law enforcement bodies: the Khyber Pakhtunkhwa Police, the Islamabad Police, and the Punjab Safe Cities Authority, which runs the command and control system for police in major Punjab cities.
Separate motives, same target
SentinelLabs said it grouped the activity into four clusters based on malware family: PlugX, ShadowPad, and Cobalt Strike — all associated with China-nexus actors — and Remcos, linked to a suspected India-nexus actor the researchers identified as overlapping with a group tracked elsewhere as TAG-179, Mysterious Elephant, or APT-C-08 (Bitter).
The China-linked activity, researchers said, is most likely driven by Beijing’s concerns for Chinese nationals working on projects tied to the China-Pakistan Economic Corridor (CPEC), who have been targeted in a string of deadly attacks, including the October 2024 Karachi airport bombing and a March 2024 suicide attack in northwestern Pakistan.
Chinese officials have previously voiced open frustration with Pakistan’s security performance, with China’s ambassador calling the attacks “unacceptable” in October 2024.
The India-linked activity, by contrast, is assessed to stem from the long-running rivalry between the two countries over Balochistan, a province at the centre of mutual accusations: Pakistan has accused India of backing Baloch separatist militants, while India accuses Pakistan of supporting militancy in Kashmir. Both countries deny the respective allegations.
Complaint portal weaponised
The report singled out the compromise of Balochistan Police’s Complaint Management System (CMS), a public-facing web application used by both police staff and citizens to file and track complaints. Researchers said a China-linked actor uploaded malware disguised as a routine portal update to the CMS site in late 2024.
One variant, disguised as a component of Chinese antivirus software 360 Safe Guard, deployed an AsyncRAT backdoor. Researchers linked the malware, via shared code artifacts and Chinese-language debug strings, to a Chinese-speaking developer.
Successful infection, the report said, could have given attackers a foothold into internal police networks if police staff were compromised, or enabled surveillance of citizens who had filed complaints through the portal.
SentinelLabs said the case illustrates how the digitisation of public services — in this instance under an EU-supported “Smart Police Station” modernisation initiative — can widen the attack surface available to state-linked hackers, turning tools meant to improve public access to policing into vectors for espionage.
The report noted its clustering of the intrusions was based on shared malware and infrastructure rather than confirmed actor identity, and that some clusters, given their use of shared or commodity tools, may involve more than one operator.
