Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Summary: SentinelOne SentinelLABS reported sustained espionage against Pakistani law enforcement between February 2024 and April 2026, with compromised servers at Balochistan Police hosting web applications that manage criminal and biometric records. Four threat clusters were flagged using PlugX, ShadowPad, Cobalt Strike, and Remcos RAT, and attackers compromised the Complaint Management System portal to deploy implants named cms_plugin.exe that masqueraded as a portal update.
Why it matters: A portal built for citizens to file complaints became a malware delivery mechanism reaching both the public and police staff, and the same victim drew suspected China- and India-aligned actors at once - SentinelOne's Milenkoski calls that convergence itself a signal of target value.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026