China and India-linked hackers target Pakistani police

Suspected cyber espionage groups linked to China and India conducted parallel, multi-year intrusions into the networks of several Pakistani law enforcement agencies, according to new cybersecurity research. The activity, which ran from February 2024 through April 2026, primarily targeted the Balochistan Police, compromising systems that managed sensitive police and citizen data.

The report from cybersecurity firm SentinelOne details intrusions into the Balochistan Police, Khyber Pakhtunkhwa Police, Islamabad Police, and the Punjab Safe Cities Authority. The compromised assets included servers hosting web applications that manage criminal and biometric records, police personnel files, hotel and tenant registrations linked to national identity records, and citizen complaints.

Researchers identified four distinct clusters of activity based on the malware and infrastructure used: PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. The use of PlugX and ShadowPad, backdoors traditionally associated with Chinese state-aligned hacking groups, anchored the assessment of China-linked activity. The Remcos-related intrusions were linked with lower confidence to an actor tracked as TAG-179,...