A sustained cyber espionage campaign targeting multiple Pakistani law enforcement agencies has revealed the convergence of at least four distinct threat actor clusters, including groups aligned with both China and India, exploiting compromised infrastructure to deploy malware and steal sensitive data. The activity, detected by SentinelOne SentinelLABS between February 2024 and April 2026, struck servers and network appliances belonging to the Balochistan Police, the Khyber Pakhtunkhwa Police, the Islamabad Police, and the Punjab Safe Cities Authority (PSCA), highlighting the strategic value of internal security data as a target for state-sponsored intelligence gathering.
Compromised Assets at Balochistan Police
At the core of the campaign lies the compromise of multiple systems within the Balochistan Police network. Security researchers identified that attackers gained access to at least two network appliances, web servers hosting applications tied to the Smart Police Station digitalization initiative, and a Fortinet FortiMail appliance that served as the agency’s primary inbound email gateway. These systems held or had access to criminal case files, biometric records, personnel data, and citizen-facing portals.
The most notable compromise involved the Complaint Management System (CMS), hosted at cms.balochistanpolice.gov[.]pk, a web application used by police staff and citizens to register, track, and resolve complaints. Attackers uploaded a custom implant masquerading as a legitimate portal update. Two variants of this implant, both named cms_plugin.exe, were deployed. The first is a Rust-based stager designed to download and execute additional payloads from a remote server, displaying a deceptive “Update Complete! Please refresh the page” message upon execution. The second is a .NET executable disguised as 360Safe.exe, a legitimate Qihoo 360 component, that reflectively loads an AsyncRAT client for remote surveillance.
Four Threat Clusters, Four Malware Families
SentinelOne’s analysis attributed the intrusions to four distinct clusters, each deploying a unique malware family: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. The deployment of PlugX and ShadowPad — the latter widely considered a successor to the former — is traditionally linked to Chinese nation-state threat actors. The victimology observed for PlugX (between February and September 2024) and ShadowPad (between August and December 2024) extends beyond Pakistani law enforcement to government, foreign affairs, defense, and research entities across South, Southeast, Central, and East Asia, the Arabian Peninsula, and Southeast Europe, reinforcing the China-aligned assessment.
The Remcos RAT cluster was linked to an India-nexus threat actor, assessed to share infrastructure and tactical overlaps with the group known as Mysterious Elephant (also tracked as APT-C-08, APT-K-47, and TAG-179), which itself has commonalities with other India-aligned adversaries such as SideWinder, Confucius, and Bitter. Attack chains used lures related to Pakistani law enforcement, displaying decoy documents about the repatriation of illegal foreigners, including Afghan Citizen Card holders.
The Cobalt Strike cluster showed traffic to a command-and-control server at 142.171.183[.]8 that extended beyond Pakistani law enforcement to government, academic, telecommunications, and non-governmental entities across South, East, and Southeast Asia, the Middle East, and South America — a victimology profile consistent with China-aligned operations. Among the targets were Tibetan Buddhist organizations in Taiwan, which have long been subject to Chinese cyber espionage activity.
Why Law Enforcement Agencies Are Prime Targets
The convergence of multiple state-aligned actors on the same set of targets is itself a signal of the strategic value held by the compromised organizations. Law enforcement institutions possess the government’s internal security picture — data on threats within borders, criminal networks, biometric records, and operational capabilities. Compromising these systems provides an adversary with intelligence on domestic security priorities, ongoing investigations, and the personal data of both police personnel and citizens who interact with police portals.
The weaponization of the Complaint Management System exemplifies a second dimension of the threat. Hosting implants inside a portal used by both citizens and officers transforms a tool designed for accountability and accessibility into a malware delivery mechanism. Any user submitting a complaint or accessing the portal could potentially be exposed to surveillance or follow-on compromise.
What This Means for Security Teams and Policymakers
This campaign underscores the need for rigorous security assessments of web applications that handle sensitive citizen and personnel data. Government portals, particularly those that serve both internal staff and the public, represent a high-risk attack surface because they are internet-facing, must handle sensitive data, and often rely on legacy architectures. Organizations that manage similar systems should prioritize application-layer segmentation, network monitoring for anomalous traffic to known malware command-and-control infrastructure, and regular penetration testing of web applications that interface with identity or biometric databases.
For cybersecurity teams defending law enforcement or government networks, the use of commodity malware such as PlugX, ShadowPad, and Cobalt Strike, combined with custom implants designed to blend into legitimate software, demands detection capabilities that extend beyond signature-based tools. Behavioral analysis, network traffic anomaly detection, and endpoint detection and response (EDR) solutions are essential for identifying implants that masquerade as application updates or legitimate binaries.
What Affected Users Should Do Now
Individuals who have interacted with the Balochistan Police Complaint Management System or other compromised portals should assume that their personal data may have been exposed. Affected citizens should enable multi-factor authentication on all accounts that support it, monitor for phishing attempts that leverage stolen data, and use a reputable no-log VPN service when accessing law enforcement or government portals over public networks. Law enforcement personnel who used the compromised systems should treat their work credentials as potentially compromised and follow their organization’s incident response procedures for credential rotation and account review. For organizations managing similar citizen-facing portals, an immediate security audit of web application infrastructure and a review of server-side file integrity monitoring are recommended first steps to detect any unauthorized modifications masquerading as updates.
