State-Backed Hackers Exploit Balochistan Police Web Portals
Multiple advanced persistent threat groups linked to China and India targeted Pakistani law enforcement infrastructure over a two-year campaign. The attacks compromised servers handling sensitive police and citizen data through weaponized web applications.
TL;DR
- China- and India-linked APT groups conducted sustained espionage against Pakistani law enforcement from Feb 2024-April 2026
- Balochistan Police web servers hosting citizen and criminal data were compromised
- Attackers exploited web application vulnerabilities to gain persistent access
- Targets included multiple law enforcement organizations across Pakistan
- Campaign demonstrates ongoing geopolitical cyber conflict in South Asia
Cybersecurity researchers have uncovered a sophisticated multi-year espionage operation targeting Pakistani law enforcement agencies. The campaign, running from February 2024 through April 2026, involved threat actors with suspected ties to both China and India.
The primary target was the Balochistan Police's web infrastructure, where attackers successfully compromised servers hosting critical applications. These systems managed sensitive data involving both police operations and citizen information, including criminal records and personal details.
Technical Attack Vectors
- Threat actors exploited vulnerabilities in web applications to gain initial access to police servers
- Compromised assets included database servers storing citizen and criminal records
- Attackers maintained persistent access for extended periods to exfiltrate sensitive information
- Web portals were weaponized to serve as command and control infrastructure
Geopolitical Implications
- This represents one of the longest-running dual-nation cyber espionage campaigns observed in the region
- Targeting law enforcement data provides strategic intelligence on internal security operations
- The campaign highlights the increasing militarization of web infrastructure in state conflicts
- South Asian cyber operations continue to evolve in sophistication and duration
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.