Ethical Hacking News
Hackers Exploit Vulnerabilities in Pakistani Law Enforcement Portal, Leaving Citizens and Police Personnel Exposed to Malware
Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. The compromised assets included servers hosting web applications that manage police and citizen data, such as criminal and biometric records. The attack has drawn both a "partner and an adversary of Pakistan" to the same victim for intelligence gathering, likely fueled by geopolitical motives.
Pakistani law enforcement organizations were targeted by suspected China- and India-aligned threat actors between February 2024 and April 2026. A sophisticated cyber espionage campaign was discovered, compromising servers hosting police and citizen data, including criminal and biometric records. Four different threat clusters were identified, each deploying a unique malware family: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. The deployment of PlugX and ShadowPad is associated with Chinese nation-state hacking groups, while the Remcos-related intrusion set shares infrastructure with an Indian-nexus adversary group. Threat actors used lures related to Pakistani law enforcement, displaying a decoy document that purports to contain an operational plan for the repatriation of illegal foreigners. Cobalt Strike activity cluster's ties to China-nexus threat actors are based on its victimology profile consistent with China-aligned hackers. The compromise of several assets, including network appliances and web servers, took place between June 2024 and April 2026.
Threat Intelligence / Cyber Espionage
A recent disclosure by cybersecurity researchers has shed light on a sophisticated cyber espionage campaign undertaken by suspected China- and India-aligned threat actors against several Pakistani law enforcement organizations between February 2024 and April 2026. The compromised assets included servers hosting web applications that manage police and citizen data, such as criminal and biometric records. Aleksandar Milenkoski, principal threat researcher at SentinelOne SentinelLABS, revealed in a report published this week that the China-nexus threat actor had compromised one of these web applications to deploy a custom implant masquerading as a portal update.
The application in question, named Complaint Management System (CMS), serves police staff and citizens, thereby putting both categories of users within the attacker's orbit. SentinelOne detected compromised infrastructure associated with several other Pakistani law enforcement organizations, including the Khyber Pakhtunkhwa Police, the Islamabad Police, and the Punjab Safe Cities Authority (PSCA). Four different threat clusters have been flagged, each deploying a unique malware family: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT.
The deployment of both PlugX and ShadowPad, the latter of which is considered a successor to PlugX, is traditionally associated with Chinese nation-state hacking groups. The victimology for PlugX and ShadowPad includes government, foreign affairs, defense, nongovernmental, and research entities across South, Southeast, Central, and East Asia, the Arabian Peninsula, and Southeast Europe, consistent with China-aligned collection.
The Remcos-related intrusion set is assessed to share infrastructure and tactical overlaps with a hacking group known as Mysterious Elephant (aka APT-C-08, APT-K-47, and TAG-179), which has commonalities with India-nexus adversaries such as SideWinder, Confucius, and Bitter. Attack chains have been found to employ lures related to Pakistani law enforcement, displaying a decoy document that purports to contain an operational plan for the repatriation of illegal foreigners, including Afghan Citizen Card (ACC) holders.
The Cobalt Strike activity cluster's ties to China-nexus threat actors is based on the fact that traffic to the attacker-controlled command-and-control (C2) server ("142.171.183[.]8") extends beyond Pakistani law enforcement to government, academic, telecommunications, and non-governmental entities across South, East, and Southeast Asia, the Middle East, and South America – a victimology profile consistent with China-aligned hackers.
Further examination of the activity aimed at Balochistan Police has uncovered the compromise of the following assets that took place between June 2, 2024, and April 9, 2026:
- Two network appliances
- Web servers hosting several Balochistan Police web applications associated with the Smart Police Station digitalization initiative
- A Fortinet FortiMail appliance that had served as the agency's primary inbound email gateway
- One of the infected applications is the Complaint Management System ("cms.balochistanpolice.gov[.]pk"), which is used for registering, tracking, and resolving citizen complaints
Two distinct variants of an implant called "cms_plugin.exe" have been uploaded to the site in connection with the operation – a Rust stager that's designed to download an additional payload from "193.42.25[.]65" and execute it. The exact nature of the next stage is unknown, but the samples display a message "Update Complete! Please refresh the page" upon execution, mimicking a CMS portal update.
A .NET executable that masquerades as 360Safe.exe, a legitimate binary used by Qihoo 360 Total Security, to reflectively load an assembly implementing an AsyncRAT client. The activity is notable because it has drawn both a "partner and an adversary of Pakistan" to the same victim for intelligence gathering, likely fueled by geopolitical motives.
"When multiple cyberespionage actors operate against law enforcement institutions of a single state, the convergence itself is a signal of target value," Milenkoski explained. "What draws them is a particular kind of institution: one that holds the government’s internal security picture, what it knows about the threats inside its borders, and how it acts against them."
"The compromise of the Complaint Management System web application adds a second dimension to the activity against Balochistan Police, extending the threat actor's reach beyond the initially compromised environment. By hosting implants in a portal used by both citizens and law enforcement personnel, the threat actor turned a tool built to make policing in Pakistan more accessible and accountable to the public into a malware delivery mechanism."
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Exploit-Vulnerabilities-in-Pakistani-Law-Enforcement-Portal-Leaving-Citizens-and-Police-Personnel-Exposed-to-Malware-ehn.shtml
https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html
Published: Sat Jul 11 14:19:19 2026 by llama3.2 3B Q4_K_M
