[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzNPjYi3ArmjjoCtiaxFUd0NEP0A2RUI99lPKy1YC_So":3},{"article":4,"iocs":48,"watch_terms":64,"solutions":65,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"4b239426-21e0-4fc5-9c1b-6f899db3e255","Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns","hackers-weaponize-balochistan-police-portal-in-multi-group-espionage-campaigns-5a7828","Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. \"At Balochistan Police, the compromised assets included servers hosting web applications that manage police and citizen data, such as criminal and","Suspected China- and India-aligned threat actors have engaged in sustained cyber espionage against Pakistani law enforcement organizations between February 2024 and April 2026. The attackers compromised web applications managing sensitive police and citizen data, deploying custom implants and utilizing malware families like PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. The campaigns targeted multiple police departments and authorities, with victimology suggesting state-sponsored activity.","Hackers weaponize Balochistan Police portal in multi-group espionage campaigns targeting Pakistani law enforcement.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhackers-weaponize-balochistan-police.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEimRVwRIhs54UhNHyRll9YzVxICmTpgqwjAK1Sy7vYt6FAzb9oImcFpuM0J8dOWdtdjCdlROkternhP9r5jZD9HNvwVwcyRzhesdYgbVjUpJk7p4rxDDJSdEUibs1Gk-Ihy1bTcxs8fA7kgG49ImfTWEZO6068Ui-_X6sTTraCg8lFuucYJrUJi2RhdXyG2\u002Fs1600\u002Fpakistan.jpg","2026-07-11T17:49:31+00:00","2026-07-11T20:00:18.781782+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Mysterious Elephant","threat_actor",{"name":21,"type":19},"APT-C-08",{"name":23,"type":19},"APT-K-47",{"name":25,"type":19},"TAG-179",{"name":27,"type":19},"SideWinder",{"name":29,"type":19},"Confucius","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59,61],{"type":50,"value":51,"context":52},"ip","142.171.183.8","Command-and-control (C2) server used by Cobalt Strike activity cluster.",{"type":42,"value":54,"context":55},"PlugX","Malware family deployed by China-nexus threat actors.",{"type":42,"value":57,"context":58},"ShadowPad","Malware family deployed by China-nexus threat actors, successor to PlugX.",{"type":42,"value":60,"context":55},"Cobalt Strike",{"type":42,"value":62,"context":63},"Remcos RAT","Malware family linked to an India-nexus threat actor.",[],{"controls":66,"vendors":154},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":126,"name":127,"problem":128,"products":129},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[155],{"slug":156,"name":157,"logo_path":158,"roles":159},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png",[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":180},"state-sponsored-actors-exploit-police-web-portals-in-multi-year-espionage-campaign","State-Sponsored Actors Exploit Police Web Portals in Multi-Year Espionage Campaign","Threat actors aligned with China and India exploited vulnerabilities in Pakistani law enforcement web applications over a two-year period, gaining persistent access to sensitive police and citizen data. The root cause centers on inadequately hardened and unpatched internet-facing web applications that provided an entry point for sophisticated implants such as PlugX, ShadowPad, and Cobalt Strike. Once inside, attackers maintained long-term footholds, suggesting a failure in both continuous vulnerability management and anomaly detection. This matters because law enforcement databases contain highly sensitive personal and operational data whose compromise can endanger citizens, informants, and active investigations. State-sponsored espionage of this duration signals systemic security gaps rather than a single oversight.",[166,167,168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-1: Network Monitoring","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1059: Command and Scripting Interpreter","ISO\u002FIEC 27001 A.12.6: Technical Vulnerability Management","ITIL: Problem Management (root cause elimination for recurring vulnerabilities)",{}]