Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026.  "At **Balochistan Police**, the compromised assets included servers hosting web applications that manage police and citizen data, such as criminal and biometric records," **Aleksandar Milenkoski**, principal threat researcher at **SentinelOne SentinelLABS**, said in a report published this week. This activity targeted network appliances and servers hosting web applications that manage biometric records, hotel and tenant registrations linked to national identity records, criminal case files, and personnel records. ### Malware and Threat Actor Attribution The China-nexus threat actor is also said to have compromised one of these web applications to deploy a custom implant masquerading as a portal update. The application in question, named Complaint Management System (CMS), serves police staff and citizens, thereby putting both categories of users within the attacker's orbit. **SentinelOne** reported detecting compromised infrastructure associated with several other Pakistani law enforcement organizations, including the **Khyber Pakhtunkhwa Police**, the **Islamabad Police**, and the **Punjab Safe Cities Authority (PSCA)**. Four different threat clusters have been flagged, each deploying a unique malware family: **PlugX**, **ShadowPad**, **Cobalt Strike**, and **Remcos RAT**. The use of **Remcos RAT** has been linked to an India-nexus threat actor, while the **PlugX**, **ShadowPad**, and **Cobalt Strike** clusters are built on shared or commodity tooling and may each involve more than one operator. That having said, the deployment of both **PlugX** and **ShadowPad**, the latter of which is considered a successor to **PlugX**, is traditionally associated with Chinese nation-state hacking groups. "The victimology we observed for **PlugX** (between 27 February and 28 September 2024) and **ShadowPad** (between 3 August and 1 December 2024) reinforces this assessment," the cybersecurity company said.  "Beyond Pakistani law enforcement, victimology for **PlugX** and **ShadowPad** includes government, foreign affairs, defense, nongovernmental, and research entities across South, Southeast, Central, and East Asia, the Arabian Peninsula, and Southeast Europe, consistent with China-aligned collection." The **Remcos**-related intrusion set is assessed to share infrastructure and tactical overlaps with a hacking group known as **Mysterious Elephant** (aka **APT-C-08**, **APT-K-47**, and **TAG-179**), which, in turn, has commonalities with India-nexus adversaries such as **SideWinder**, **Confucius**, and **Bitter**. Attack chains have been found to employ lures related to Pakistani law enforcement, displaying a decoy document that purports to contain an operational plan for the repatriation of illegal foreigners, including **Afghan Citizen Card** (ACC) holders. The **Cobalt Strike** activity cluster's ties to China-nexus threat actors is based on the fact that traffic to the attacker-controlled command-and-control (C2) server ("142.171.183[.]8") extends beyond Pakistani law enforcement to government, academic, telecommunications, and non-governmental entities across South, East, and Southeast Asia, the Middle East, and South America – a victimology profile consistent with China-aligned hackers. Among those targeted are Tibetan Buddhist organizations in Taiwan, which have long been targeted by China for cyber espionage. ### Compromised Assets and Delivery Mechanisms Further examination of the activity aimed at **Balochistan Police** has uncovered the compromise of the following assets that took place between June 2, 2024, and April 9, 2026: * Two network appliances * Web servers hosting several **Balochistan Police** web applications associated with the **Smart Police Station** digitalization initiative * A **Fortinet FortiMail** appliance that had served as the agency's primary inbound email gateway One of the infected applications is the Complaint Management System ("cms.balochistanpolice.gov[.]pk"), which is used for registering, tracking, and resolving citizen complaints. Two distinct variants of an implant called "cms_plugin.exe" have been uploaded to the site in connection with the operation: * A **Rust** stager that's designed to download an additional payload from "193.42.25[.]65" and execute it. The exact nature of the next stage is unknown, but the samples display a message "Update Complete! Please refresh the page" upon execution, mimicking a CMS portal update. * A **.NET** executable that masquerades as "**360Safe.exe**," a legitimate binary used by **Qihoo 360 Total Security**, to reflectively load an assembly implementing an **AsyncRAT** client. ### Geopolitical Motivations and Implications The activity is notable because it has drawn both a "partner and an adversary of Pakistan" to the same victim for intelligence gathering, likely fueled by geopolitical motives. "When multiple cyberespionage actors operate against law enforcement institutions of a single state, the convergence itself is a signal of target value," **Milenkoski** explained. "What draws them is a particular kind of institution: one that holds the government’s internal security picture, what it knows about the threats inside its borders, and how it acts against them." "The compromise of the Complaint Management System web application adds a second dimension to the activity against **Balochistan Police**, extending the threat actor's reach beyond the initially compromised environment. By hosting implants in a portal used by both citizens and law enforcement personnel, the threat actor turned a tool built to make policing in Pakistan more accessible and accountable to the public into a malware delivery mechanism."