SentinelLABS identified sustained cyberespionage activity by suspected China-nexus and India-nexus threat actors against Pakistani law enforcement organizations from February 2024 to April 2026, with both converging on Balochistan Police. Four C2 clusters (PlugX, ShadowPad, Cobalt Strike, Remcos) were mapped to compromised infrastructure. A China-nexus actor compromised the Balochistan Police Complaint Management System (CMS), deploying custom implants (cms_plugin.exe) disguised as portal updates that delivered AsyncRAT and staged payloads from attacker-controlled servers, targeting both police personnel and citizens. The implants share a development environment (D:\codedome PDB prefix) with Chinese-language indicators, attributing them to a Chinese-speaking developer.
Balochistan Police
1 post
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement