[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fm1sSn-ug0e3njGpGwSLue7oDvhrU9dbIOTp_REKqXyo":3},{"article":4,"iocs":46,"watch_terms":56,"solutions":57,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"49e081a3-54b7-4137-b285-d34aff62a6e5","China, India-Linked Hackers Both Targeted Same Pakistani Police Force","china-india-linked-hackers-both-targeted-same-pakistani-police-force-8682db","Both foes and allies have targeted the Balochistan Police force in Pakistan for at least two years, according to SentinelOne. The post China, India-Linked Hackers Both Targeted Same Pakistani Police Force appeared first on SecurityWeek.","Cyberespionage groups associated with both China and India have been observed infiltrating Pakistani law enforcement networks, including the Balochistan Police, for at least two years. The intrusions, which ran from February 2024 to April 2026, targeted sensitive data like biometric databases and criminal case files, utilizing malware such as PlugX, ShadowPad, Cobalt Strike, and Remcos. Researchers suggest China's motive is to assess threats to its Belt and Road projects, while India's interest lies in monitoring Pakistan's handling of Baloch separatists.","China and India-linked hackers targeted Pakistan's Balochistan Police for over two years.","https:\u002F\u002Fwww.securityweek.com\u002Fchina-india-linked-hackers-both-targeted-same-pakistani-police-force\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-07-10T11:55:11+00:00","2026-07-10T12:00:24.637761+00:00",8,[17,20,22,25],{"name":18,"type":19},"China-linked cyberspies","threat_actor",{"name":21,"type":19},"India-linked activity",{"name":23,"type":24},"SentinelOne","vendor",{"name":26,"type":27},"SentinelLabs","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,52,54],{"type":40,"value":48,"context":49},"PlugX","Malware used in intrusions",{"type":40,"value":51,"context":49},"ShadowPad",{"type":40,"value":53,"context":49},"Cobalt Strike",{"type":40,"value":55,"context":49},"Remcos",[23,26],{"controls":58,"vendors":139},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":118,"name":119,"problem":120,"products":121},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[122,123,131],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[140],{"slug":141,"name":23,"logo_path":142,"roles":143},"sentinelone","\u002Fvendor-logos\u002Fsentinelone.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":163},"dual-nation-state-actors-breach-pakistani-police-networks-for-two-years-undetected","Dual Nation-State Actors Breach Pakistani Police Networks for Two Years Undetected","Two separate nation-state threat actors — linked to China and India — simultaneously compromised Pakistani law enforcement networks for over two years, exfiltrating highly sensitive data including biometric databases and criminal case files. The prolonged, undetected nature of the intrusions suggests critical failures in network segmentation, endpoint monitoring, and threat detection capabilities. Tools like PlugX, ShadowPad, and Cobalt Strike are well-documented APT staples, meaning signature-based and behavioral detection should have flagged their presence far sooner. The targeting of biometric data is particularly alarming, as this information cannot be changed once compromised, creating permanent identity and operational security risks for law enforcement personnel. This case demonstrates that government agencies in geopolitically sensitive regions are high-value targets requiring defense-in-depth strategies commensurate with nation-state threat levels.",[150,151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 3: Data Protection","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-6: Audit Record Review and Reporting","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.DS-5: Protections Against Data Leaks","MITRE ATT&CK T1059: Command and Scripting Interpreter","MITRE ATT&CK T1071: Application Layer Protocol (C2)","ISO\u002FIEC 27001 A.8.2: Information Classification","ISO\u002FIEC 27001 A.12.4: Logging and Monitoring",{}]