Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Threat actors aligned with China and India exploited vulnerabilities in Pakistani law enforcement web applications over a two-year period, gaining persistent access to sensitive police and citizen data. The root cause centers on inadequately hardened and unpatched internet-facing web applications that provided an entry point for sophisticated implants such as PlugX, ShadowPad, and Cobalt Strike. Once inside, attackers maintained long-term footholds, suggesting a failure in both continuous vulnerability management and anomaly detection. This matters because law enforcement databases contain highly sensitive personal and operational data whose compromise can endanger citizens, informants, and active investigations. State-sponsored espionage of this duration signals systemic security gaps rather than a single oversight.