Hackers Target Balochistan Police Portal for Espionage

Cybersecurity researchers have detailed extensive cyber espionage operations targeting Pakistani law enforcement agencies, conducted by threat actors believed to be aligned with China and India. These campaigns, active from February 2024 through April 2026, specifically compromised the Balochistan Police portal. The compromised assets at Balochistan Police included servers that managed sensitive police and citizen data, such as criminal records. This breach allowed threat actors access to critical information, facilitating espionage activities.

The research indicates a multi-group effort, suggesting a coordinated approach to intelligence gathering against Pakistani law enforcement. The attackers leveraged sophisticated techniques to gain and maintain access to these sensitive systems. The prolonged nature of the campaign, spanning over two years, highlights the persistence and advanced capabilities of the involved threat actors. The primary objective appears to be intelligence collection rather than financial gain, characteristic of state-sponsored espionage.

While the specific details of the data exfiltrated are not fully disclosed, the nature of the compromised servers points to access to criminal databases, citizen information, and internal police operational data. This information could be used for various purposes, including identifying informants, understanding law enforcement strategies, or conducting further targeted attacks. The involvement of both China- and India-aligned groups in separate or potentially coordinated efforts adds a complex geopolitical dimension to the cyber espionage activities.

This incident underscores the vulnerability of critical infrastructure, including law enforcement databases, to advanced persistent threats. The researchers' findings emphasize the need for enhanced cybersecurity measures and continuous monitoring of government and law enforcement networks to detect and mitigate such sophisticated espionage campaigns. The disclosure aims to alert relevant authorities and the cybersecurity community to the evolving threat landscape and the tactics employed by nation-state-backed actors.