12 minhigh
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement
SentinelLABS identified sustained cyberespionage activity by suspected China-nexus and India-nexus threat actors against Pakistani law enforcement organizations from February 2024 to April 2026, with both converging on Balochistan Police. Four C2 clusters (PlugX, ShadowPad, Cobalt Strike, Remcos) were mapped to compromised infrastructure. A China-nexus actor compromised the Balochistan Police Complaint Management System (CMS), deploying custom implants (cms_plugin.exe) disguised as portal updates that delivered AsyncRAT and staged payloads from attacker-controlled servers, targeting both police personnel and citizens. The implants share a development environment (D:\codedome PDB prefix) with Chinese-language indicators, attributing them to a Chinese-speaking developer.
Sens:▲ 24h
Showing defanged values
- domaincms[.]balochistanpolice[.]gov[.]pkCompromised Balochistan Police Complaint Management System domain; threat actor uploaded custom implants to /client scripts/ directory disguised as portal updates
- filename360Safe.exeMasqueraded filename used by .NET cms_plugin.exe variant, impersonating Qihoo 360 Safe Guard endpoint security component; reflectively loads AsyncRAT client assembly
- filenamecms_plugin.exeCustom implant deployed on Balochistan Police CMS; two variants identified (Rust stager and .NET executable), both masquerading as CMS portal updates with message 'Update Complete! Please refresh the page'
- ip142[.]171[.]183[.]8Cobalt Strike C2 server attributed to China-nexus actors; communicated with Pakistani law enforcement and broader government/academic/telecom victims across Asia, Middle East, and South America
- ip193[.]42[.]25[.]65Cobalt Strike C2 server attributed to China-nexus actor; also served as next-stage payload download server for Rust-based cms_plugin.exe stager deployed on Balochistan Police CMS
- ip41[.]216[.]188[.]140AsyncRAT C2 server configured in .NET assembly embedded within cms_plugin.exe (masquerading as 360Safe.exe) deployed on Balochistan Police CMS
- ip89[.]31[.]121[.]220Remcos C2 server attributed to India-nexus TAG-179; also documented by Qihoo 360 as delivering Remcos backdoor in infection chains targeting Pakistani law enforcement
Detection / Hunteropenrouter
What Happened
Between 2024 and 2026, hackers believed to be working for both China and India separately broke into computer systems used by Pakistani police forces, especially the Balochistan Police. The attackers compromised servers that store sensitive information like criminal records, biometric data, and citizen complaints. In one case, a China-linked hacker tampered with a police website that both officers and ordinary citizens use to file and track complaints, turning it into a trap that delivered malware to anyone who visited it. The malware was disguised as a software update for the website. China's likely interest is monitoring threats to its own citizens working in Pakistan, while India's likely interest is gathering intelligence on a rival nation's security operations. Organizations using similar digital policing systems should review their web application security, monitor for unauthorized file uploads, and ensure that public-facing portals cannot be used to deliver malware to visitors.
Key Takeaways
- Suspected China-nexus and India-nexus threat actors independently compromised Pakistani law enforcement infrastructure, converging on Balochistan Police between February 2024 and April 2026
- A China-nexus actor weaponized the Balochistan Police Complaint Management System (CMS) by hosting custom implants disguised as portal updates, targeting both police staff and citizens
- Four C2 activity clusters identified by tooling: PlugX, ShadowPad, Cobalt Strike (China-nexus), and Remcos (India-nexus TAG-179/Bitter)
- CMS implants include a Rust-based stager and a .NET executable masquerading as 360Safe.exe that reflectively loads an AsyncRAT client, with PDB paths and Chinese-language log strings pointing to a Chinese-speaking developer
- Compromised assets exposed biometric records, criminal case files, personnel records, hotel/tenant registrations, and citizen complaint data
Affected Systems
- Balochistan Police web servers hosting Smart Police Station applications
- Balochistan Police Complaint Management System (CMS) at cms.balochistanpolice.gov.pk
- Balochistan Police network appliances
- Fortinet FortiMail appliance (former primary inbound email gateway for Balochistan Police)
- Khyber Pakhtunkhwa Police infrastructure
- Islamabad Police infrastructure
- Punjab Safe Cities Authority (PSCA) infrastructure
- Windows endpoints used by Pakistani law enforcement personnel and citizens accessing the CMS portal
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Suspected China-nexus and India-nexus actors compromise Balochistan Police network appliances, web servers, and a FortiMail appliance via unspecified means
- Credential Access: Stolen CMS login credentials (ps- prefix convention) retrieved from information stealer logs on dark web used to access restricted police portal functions
- Persistence/Weaponization: China-nexus actor uploads custom implants (cms_plugin.exe) to compromised CMS web application at /client scripts/ directory, disguised as portal updates
- Execution: Police staff and citizens visiting the CMS portal are prompted to download and execute cms_plugin.exe, which displays 'Update Complete! Please refresh the page'
- C2: Rust variant downloads next-stage payload from 193.42.25.65; .NET variant reflectively loads AsyncRAT client configured to communicate with 41.216.188.140
- Collection: Threat actors access data stores backing Smart Police Station applications including biometric records, criminal case files, personnel records, and citizen complaints
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article references an IOC table listing SHA-1 hashes, IP addresses, and URLs, but the actual values were not included in the provided text. No detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are present in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The .NET variant uses reflective assembly loading of AsyncRAT, which may be visible via EDR process telemetry and memory scanning. The Rust stager downloads and executes payloads, which should generate process creation events. However, the custom nature of the stagers and the masquerading as legitimate software (360Safe.exe) may reduce detection by signature-based controls. |
| Network Visibility | High | C2 communications were identified through netflow data analysis. The four C2 clusters (PlugX, ShadowPad, Cobalt Strike, Remcos) and AsyncRAT C2 server are identifiable via network traffic to known-bad IPs. The CMS implant delivery URL path is also network-observable. |
| Detection Difficulty | Moderate | C2 IP addresses and the compromised domain are known and can be blocked or alerted on. The use of known malware frameworks (AsyncRAT, Cobalt Strike, PlugX, ShadowPad, Remcos) provides signature opportunities. However, the custom Rust stager, reflective loading technique, and masquerading as legitimate software add complexity. The watering-hole delivery via a legitimate government portal is inherently difficult to distinguish from normal traffic without endpoint telemetry. |
Required Log Sources
- Netflow / network traffic analysis logs
- Web server access logs for compromised CMS application
- EDR process creation and module loading events
- DNS resolution logs
- Proxy / web gateway logs for outbound C2 traffic
- File upload logs on web applications
- Information stealer log feeds (dark web monitoring)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for endpoints communicating with known C2 IP addresses associated with the four activity clusters, particularly any connections to 193.42.25.65 or 41.216.188.140 from systems that also accessed Pakistani government web portals | Netflow, proxy logs, DNS resolution logs, firewall connection logs | Command and Control | Low — these are specific IP addresses with no known legitimate hosting purpose; however, shared hosting or CDN migration could create false positives over time |
| Consider hunting for processes named cms_plugin.exe or 360Safe.exe executing from browser download directories or temporary locations, particularly on systems used by law enforcement or government personnel | EDR process creation events, file system monitoring, browser download logs | Execution | Medium — 360Safe.exe is a legitimate Qihoo 360 component name; verify execution path and parent process to distinguish masqueraded instances from genuine software |
| Consider hunting for .NET processes with reflective assembly loading behavior, particularly those loading assemblies with PDB paths containing the D:\codedome prefix or Chinese pinyin terms such as xinshi | EDR module loading events, .NET assembly load events (ETW), memory scanning | Execution | Low — the D:\codedome PDB path prefix is highly specific to this developer's build environment and unlikely to appear in legitimate software |
| Consider hunting for web application file upload events to /client scripts/ or similar directories on government web servers, particularly executable files (.exe) uploaded outside of normal maintenance windows | Web server access logs, file integrity monitoring, WAF logs | Persistence | Low to Medium — legitimate application updates may involve file uploads; correlate with change management records and verify file type appropriateness for the directory |
| Consider hunting for credential reuse patterns where usernames with ps- prefix convention appear in authentication logs alongside access from information stealer-associated infrastructure or anomalous geographic locations | Authentication logs, identity and access management logs, threat intelligence feeds for stealer logs | Credential Access | Medium — legitimate police personnel will use ps- prefix credentials; focus on anomalous access patterns, new device fingerprints, or unusual source IPs rather than the username format alone |
Control Gaps
- Web application firewalls may not detect file uploads of executable payloads to legitimate application directories by authenticated or privileged users
- Signature-based antivirus may not detect the custom Rust stager variant as it is a novel implant with limited sample availability
- Network-based detection alone cannot identify endpoint compromise when C2 uses legitimate-appearing HTTP(S) traffic to known-bad IPs that have not yet been flagged
- Watering-hole attacks via legitimate government portals bypass traditional phishing controls and email security gateways
- Decommissioned but still operational network appliances (e.g., the former FortiMail gateway) may not receive the same monitoring and patching attention as production systems
Key Behavioral Indicators
- Process executing from browser download or temporary directory with filename cms_plugin.exe or 360Safe.exe
- Reflective loading of .NET assembly within a process masquerading as 360Safe.exe
- PDB path containing D:\codedome prefix in loaded modules
- HTTP(S) connections to 193.42.25.65 or 41.216.188.140 from endpoints that accessed cms.balochistanpolice.gov.pk
- Executable files uploaded to web application /client scripts/ directories
- Chinese-language log strings containing '随机序列碰撞' (random sequence collision) in .NET process memory or logs
- Authentication events using ps- prefix credentials from anomalous locations or unrecognized devices
False Positive Assessment
Medium — The 360Safe.exe masquerade filename is a legitimate Qihoo 360 product component, which could generate false positives in environments where the genuine software is deployed. The ps- prefix credential convention is legitimate for Pakistani police personnel. C2 IP addresses may have low false positive rates but could be repurposed over time. The D:\codedome PDB path is highly specific and unlikely to generate false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 IP addresses (89.31.121.220, 193.42.25.65, 41.216.188.140, 142.171.183.8) at network perimeter controls if applicable to your environment
- If your organization operates or supports Pakistani law enforcement infrastructure, consider prioritizing forensic review of web servers and network appliances for unauthorized file uploads, particularly in /client scripts/ directories
- Consider searching endpoint telemetry for any historical connections to the identified C2 IPs or execution of cms_plugin.exe / 360Safe.exe from non-standard paths
- If applicable, consider rotating credentials for any web applications where stolen login credentials (ps- prefix convention) may have been exposed via information stealer logs
Infrastructure Hardening
- Consider implementing file integrity monitoring on web application directories to detect unauthorized executable uploads, particularly for public-facing government portals
- Evaluate whether decommissioned but still operational network appliances (e.g., former email gateways) should be fully decommissioned or brought under the same monitoring and patching regime as production systems
- Consider implementing network segmentation to limit lateral movement from compromised web servers to backend data stores containing sensitive records
- If your organization manages web applications serving both internal staff and public users, consider evaluating whether file upload functionality can be restricted or sandboxed to prevent malware delivery to visitors
- Consider reviewing web application authentication for government portals to detect credential reuse from information stealer compromises, including monitoring dark web credential leaks
User Protection
- Consider deploying EDR with behavioral detection capabilities that can identify reflective .NET assembly loading and masquerading techniques on endpoints used by law enforcement personnel
- If applicable, consider implementing browser security controls that warn users when downloading executable files from government web portals, particularly during unexpected 'update' prompts
- Consider evaluating whether endpoint protections can detect AsyncRAT, Cobalt Strike, PlugX, ShadowPad, and Remcos beaconing behavior on law enforcement networks
Security Awareness
- Consider incorporating awareness training about watering-hole attacks targeting government and law enforcement portals, emphasizing that legitimate-looking 'update' prompts on web applications may deliver malware
- Consider training users to verify software update authenticity through official channels rather than executing files downloaded directly from web portal directories
- If relevant to your organization, consider briefing law enforcement personnel on the risk of credential exposure through information stealer malware and the importance of unique, strong passwords for sensitive portals
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Paths:
D:\codedome\case\six\Client\Client2\obj\Debug\Client2.pdb- PDB path embedded in .NET AsyncRAT client assembly loaded by cms_plugin.exe; pivot point identifying multiple samples from same Chinese-speaking developer environment
- Other:
ps-barkhan- Example stolen CMS login credential username with ps- prefix (denoting police station) followed by Balochistan district name; retrieved from information stealer logs on dark web
