[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNDWoXT0J9YDRLVOipbuvRtCr58Iu_VcMy-Ni_WmIxrk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":65},"77ce2394-e8a7-40ae-8e84-23867a547c75","state-sponsored-actors-exploit-police-web-portals-in-multi-year-espionage-campaign","4b239426-21e0-4fc5-9c1b-6f899db3e255","State-Sponsored Actors Exploit Police Web Portals in Multi-Year Espionage Campaign","Threat actors aligned with China and India exploited vulnerabilities in Pakistani law enforcement web applications over a two-year period, gaining persistent access to sensitive police and citizen data. The root cause centers on inadequately hardened and unpatched internet-facing web applications that provided an entry point for sophisticated implants such as PlugX, ShadowPad, and Cobalt Strike. Once inside, attackers maintained long-term footholds, suggesting a failure in both continuous vulnerability management and anomaly detection. This matters because law enforcement databases contain highly sensitive personal and operational data whose compromise can endanger citizens, informants, and active investigations. State-sponsored espionage of this duration signals systemic security gaps rather than a single oversight.","**Immediate actions:**\n- Conduct emergency vulnerability assessments and patching of all internet-facing web applications, prioritizing those handling sensitive citizen and law enforcement data.\n- Isolate compromised portals from internal networks and initiate forensic investigation to identify the full scope of implant deployment.\n- Deploy indicators of compromise (IoCs) for PlugX, ShadowPad, Cobalt Strike, and Remcos RAT across endpoint detection tools.\n\n**Long-term improvements:**\n- Implement a formal vulnerability management program with mandatory patch windows (e.g., critical patches within 72 hours) for public-facing government systems.\n- Enforce strict network segmentation so that web-facing applications cannot directly communicate with sensitive backend databases or internal law enforcement systems.\n- Adopt a zero-trust architecture requiring continuous verification for all access to sensitive law enforcement data repositories.\n\n**Detection measures:**\n- Deploy web application firewalls (WAFs) and intrusion detection systems (IDS) with behavioral analytics tuned to detect custom implant activity and lateral movement.\n- Establish a 24\u002F7 Security Operations Center (SOC) with threat intelligence feeds covering state-sponsored APT groups targeting government infrastructure.\n- Implement comprehensive logging and log retention policies ensuring all web application and network traffic logs are centrally stored and reviewed for anomalies.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-1: Network Monitoring","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1059: Command and Scripting Interpreter","ISO\u002FIEC 27001 A.12.6: Technical Vulnerability Management","ITIL: Problem Management (root cause elimination for recurring vulnerabilities)",{},"published","2026-07-11T20:20:42.279571+00:00","2026-07-11T20:20:41.998+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhackers-weaponize-balochistan-police.html","hackers-weaponize-balochistan-police-portal-in-multi-group-espionage-campaigns-5a7828","Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[54,60],{"id":55,"date":56,"edition":57,"title":58,"audio_url":59},"6fc50a9c-16e4-42f1-9b40-312856693c2f","2026-07-13","morning","ThreatNoir Morning Brief — July 13","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-13\u002Fthreatnoir-morning-brief-2026-07-13.mp3",{"id":61,"date":62,"edition":57,"title":63,"audio_url":64},"351805ff-95fa-4360-8cef-51c97fad3b37","2026-07-12","ThreatNoir Weekend Brief — July 12","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-12\u002Fthreatnoir-morning-brief-2026-07-12.mp3",[66,69,73],{"slug":38,"name":67,"problem":68},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":70,"name":71,"problem":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]