China, India-Linked Hackers Raid Balochistan Police

The Balochistan Police hack shows how a provincial law enforcement network can become a regional intelligence prize when it sits inside Pakistan’s most sensitive internal security theater.

China-linked and India-linked hacking groups ran separate, unconnected espionage campaigns against Pakistani law enforcement between February 2024 and April 2026, in some cases breaching the same systems, according to The Record, citing research from SentinelOne’s SentinelLabs. The core target was Balochistan Police, the force responsible for Pakistan’s southwestern province, where a long-running separatist insurgency intersects with Chinese infrastructure interests and India-Pakistan rivalry.

That is the real story beneath the intrusion report. This wasn’t just another government breach. It was a collision between local policing data and regional power politics. Criminal records, biometric data, personnel files, hotel and tenant registrations linked to national identity records, and citizen complaints are not routine back-office material in a conflict zone. They are a map of how the state sees threats inside its borders.

“When multiple cyberespionage actors operate against law enforcement institutions of a single state, the convergence itself is a signal of target value,” SentinelOne principal threat researcher Aleksandar Milenkoski wrote, according to Reuters reporting carried by regional outlets.

XOOMAR analysis: Pakistan’s problem is not only that two rival powers reportedly reached into sensitive police systems. It is that a provincial police force appears to have become a shared hunting ground because the data was both valuable and reachable.

Balochistan Police became a regional intelligence prize, and Pakistan paid the price

The Balochistan Police hack matters because the target was not a symbolic ministry website or a noisy defacement victim. It was a working law enforcement environment tied to internal security, public complaints, criminal investigations, personnel records, and identity-linked registrations.

SentinelLabs said police networks concentrate governments’ internal-security data in one place. In Balochistan, that concentration is unusually sensitive. The province has been the site of a long-running separatist insurgency, and Pakistan’s security apparatus treats it as a major internal challenge. For foreign intelligence services, access to police systems in that setting could help answer questions that public reporting cannot: who is being tracked, which incidents are prioritized, where security forces are deployed, and how state institutions interpret unrest.

China and India would read that same data through different strategic lenses.

The Record reports that SentinelLabs assessed China’s interest was driven primarily by protecting Beijing’s nationals in Pakistan connected to the China-Pakistan Economic Corridor. The report cited a March 2024 suicide bombing and an October 2024 attack near Karachi's airport as incidents affecting Chinese workers.

India-linked activity, SentinelLabs assessed, was likely tied to the rivalry between India and Pakistan. Islamabad accuses New Delhi of backing the Baloch insurgency and describes the Balochistan Liberation Army as an “Indian proxy,” while India makes parallel accusations over Kashmir. Both governments deny the other’s claims.

XOOMAR analysis: the overlap points to a hard lesson for Pakistan. When conflict-zone police data is digitized but not defended like national-security infrastructure, it becomes intelligence infrastructure for everyone else.

February 2024 to April 2026: the timeline behind the Pakistan police spying campaigns

The reported operating window, February 2024 to April 2026, is the part Pakistan’s security leadership should find hardest to dismiss. A short breach can expose data. A multi-year espionage campaign can map behavior.

SentinelLabs tracked multiple hacking campaigns against Pakistani law enforcement during that period. Related reporting citing the SentinelLabs research says the analysis flagged four distinct hacking campaigns against Pakistan’s law enforcement agencies, all reaching Balochistan Police. Other agencies named in related reporting include Khyber Pakhtunkhwa Police, Islamabad Police, and the Punjab Safe Cities Authority, though less detail is available on those intrusions.

The known metrics are stark:

• Timeframe: February 2024 to April 2026
• Primary target: Balochistan Police
• Reported actor links: China-nexus and India-nexus activity
• Data environment: criminal records, biometric and fingerprint data, personnel files, hotel and tenant records, citizen complaints
• Overlap: in some cases, the campaigns breached the exact same systems

Persistence changes the risk profile. If an intruder maintains access across months or years, they can watch changes in personnel, see how investigations evolve, identify repeated operational patterns, and understand which systems matter most to the force. The source material does not prove every sensitive dataset was stolen. That distinction matters. But server access alone can be enough to expose structure, application logic, authentication habits, naming conventions, and operational workflows.

A campaign running across years also suggests detection gaps. That does not prove negligence by any one agency, but it does point toward familiar failure modes: weak segmentation, stale credentials, unpatched public-facing systems, poor log retention, limited monitoring, and incident response capacity that cannot keep pace with state-linked operators.

The Pakistan police spying campaigns therefore look less like a single technical failure and more like a governance failure. Provincial digitization expanded the attack surface. Adversaries appear to have noticed faster than defenders could adapt.

How Chinese and Indian cyber operators may have exploited the same police systems

SentinelLabs described the compromise of the Balochistan Police Complaint Management System, a portal used by officers behind a login and by citizens checking complaint status. According to the researchers, a China-linked operator planted malware disguised as a portal update. The executable displayed a fake “update complete” message while infecting the visitor’s device.

That detail is important because the portal sat between police staff and the public. It was not only an internal system. It was a trust point.

One malware file displayed the message “Update Complete! Please refresh the page,” according to related reporting on the SentinelLabs findings.

If police personnel used the tampered portal, attackers could seek a foothold into official networks. If citizens used it, the same mechanism could compromise people filing complaints, including complaints against police officers. The source material does not document confirmed infections or confirmed data theft from that specific malware deployment. SentinelLabs also could not retrieve one next-stage payload at the time of analysis, according to related reporting. That keeps the technical conclusion narrower, but not benign.

The attribution evidence differed by cluster. For the China-nexus activity, SentinelLabs cited backdoors shared among Chinese groups, including PlugX and ShadowPad, plus victim patterns spanning Asian governments and, in one case, Tibetan organizations in Taiwan. The researchers also found Chinese-language log strings and developer artifacts pointing to a Chinese-speaking author.

For the India-nexus activity, the confidence was lower. SentinelLabs tied it to TAG-179, overlapping with clusters others call Bitter and Mysterious Elephant, partly based on a lure document themed around the repatriation of undocumented foreigners.

Two separate campaigns reaching the same environment does not imply coordination. The cleaner read is simpler and more damaging: the target was rich, exposed, or both.

Possible paths, based on the types of systems and artifacts described, include:

• Public portals: Tampered web applications can deliver malware to users who already trust the site.
• Stolen credentials: Related reporting noted staff-side login credentials recovered from infostealer logs, though not connected to the implant spread.
• Network appliances: Edge devices and gateways often become durable entry points when monitoring is thin.
• Application servers: Police modernization systems can concentrate identity-linked records behind interfaces built for operational speed, not hostile state-level scrutiny.

Multiple intruders inside one environment create their own danger. They can damage forensic trails, trip over each other’s tools, or make defenders misread one campaign as another. Worse, if future operations move from collection to data manipulation, altered records could create wrongful suspicion, disrupt investigations, or poison trust in police systems.

That last scenario is not proven here. It is the risk this case exposes.

Balochistan’s insurgency turned police networks into a proxy battlefield for China, India, and Pakistan

Balochistan is not just a place on a map in this story. It is the reason these police systems had intelligence value.

SentinelLabs connected China-nexus interest to the protection of Chinese nationals tied to the China-Pakistan Economic Corridor. The report cited attacks affecting Chinese workers, including the March 2024 suicide bombing and the October 2024 attack near Karachi's airport. If Beijing doubts that Pakistani security guarantees provide enough visibility, independent cyber collection becomes a way to reduce uncertainty.

India’s suspected interest sits in a different channel. SentinelLabs assessed the India-linked activity was likely connected to the rivalry between India and Pakistan. The report notes Pakistan’s accusations that India backs the Baloch insurgency, including Islamabad’s description of the Balochistan Liberation Army as an “Indian proxy,” while India makes parallel accusations over Kashmir. Both deny the other’s claims.

That rivalry already plays out across diplomacy, borders, and public accusation. The cyber layer gives each side a way to look inside the other’s security machinery without a public confrontation. This case shows how that pressure can land on provincial agencies rather than only national ministries or military networks.

XOOMAR analysis: in an insurgency-affected province, police data can matter as much as military data. Police systems record arrests, complaints, fingerprints, hotel stays, tenants, personnel, case filings, and local threat reporting. That is granular intelligence. It can reveal the day-to-day mechanics of state control and resistance in a way high-level policy documents cannot.

This also fits a broader movement visible in the source material itself: cyber espionage against police, municipal, and regional administrative systems, not only defense agencies. SentinelLabs noted that as Pakistan centralizes and digitizes policing, supported in part by European modernization programs, it will keep concentrating high-value data that adversaries may target.

For readers tracking regional technology and state capacity, this echoes a wider point we have covered in other contexts: national power increasingly depends on technical systems far outside traditional defense. China’s hardware ambitions, for example, show up in aerospace stories such as Sea Net Catches China’s First Reusable Rocket Booster, while India’s institutional and scientific capacity surfaces in pieces like India's Brainstem Atlas Cracks a Hidden Control Room. The same principle applies here, but in a darker register: local databases can become strategic assets.

Islamabad, Beijing, New Delhi, and Baloch communities will read this breach very differently

For Pakistan’s federal government, the reported intrusions are a sovereignty problem and a counterintelligence problem. Two rival powers allegedly touched the same law enforcement environment, and the target was not peripheral. It was a force operating in a province central to internal security and foreign investment risk.

For China, the intelligence value is practical. SentinelLabs assessed that China-nexus interest was driven primarily by protection of Chinese nationals in Pakistan tied to the China-Pakistan Economic Corridor. Beijing’s public posture rejects cyberattacks. Liu Chang, spokesperson for the Chinese Embassy in Washington, said China “firmly opposes and combats all forms of cyberattacks in accordance with the law, and does not allow any country or individual to engage in such illegal activities within China’s territory or by using China’s infrastructure,” according to Reuters reporting cited in regional coverage.

For India, visibility into Balochistan Police could offer insight into Pakistan’s internal security deployments and how Islamabad handles separatist movements. The source material does not show Indian government direction. It says the India-nexus assessment is lower-confidence and tied to TAG-179, overlapping with groups others call Bitter and Mysterious Elephant. That lower confidence should stay attached to the claim.

For Baloch civilians, activists, informants, suspects, and police officers, the stakes are more immediate. Exposure of police data can produce real-world danger long after malware is removed. A compromised complaint record could reveal who approached authorities. Personnel files could expose officers and families. Hotel and tenant registrations tied to national identity records could expose movement patterns. Fingerprint and biometric data, if accessed, cannot simply be reset like passwords.

That human layer is easy to miss in state-linked cyber stories. It is the part that matters most on the ground.

Related reporting said Khyber Pakhtunkhwa Police stated that system security is “a matter of the highest priority” and that “there is no evidence that any core KP police system, network, or critical application has been successfully compromised.” The agency also said that during heightened Pakistan-India tensions last year, it saw an increase in attempted cyber activity, and that in “one isolated incident, the login credentials of an end user were compromised.”

Those denials and caveats do not erase the Balochistan findings. They show how hard it is for public agencies to communicate partial compromise without either minimizing risk or confirming too much to adversaries.

The Balochistan Police hack forces a new security model for conflict-zone data

The prescription is blunt: police systems in insurgency-affected regions need to be treated as critical national security infrastructure, not routine provincial IT.

That starts with boring controls, which are boring only until they fail.

• Asset inventory: Agencies need to know which portals, gateways, servers, and legacy systems remain connected.
• Network segmentation: A citizen complaint portal should not provide an easy route toward internal law enforcement systems.
• Privileged access controls: Staff-side interfaces need tighter authentication, especially where stolen credentials may circulate.
• Log retention: Multi-year campaigns cannot be reconstructed if logs roll off too quickly.
• Patch cycles: Public-facing systems and network appliances need faster remediation than ordinary office software.
• Incident command: Federal and provincial agencies need clear escalation lines before a suspected state-linked intrusion lands.

Attribution matters, but it will not fix the underlying condition. Naming a China-nexus or India-nexus cluster helps policymakers understand motive and risk. It does not harden a portal, rotate credentials, isolate application servers, or preserve forensic evidence.

Pakistan’s digitization challenge is sharper because modernization has obvious benefits. Centralized complaint systems, fingerprint-matched criminal records, stolen-vehicle tracking, hotel guest registration, and tenant databases can improve policing. SentinelLabs’ warning is that those same systems concentrate high-value data. Once centralized, they become more attractive to foreign intelligence services and more dangerous when exposed.

XOOMAR analysis: the security model has to change from “protect the police network” to “protect the people represented inside the police network.” That includes witnesses, informants, officers, victims, suspects, complainants, and ordinary citizens whose identity-linked records may sit inside systems they never chose to trust.

The next cyber flashpoints sit near ports, corridors, police databases, and border security

The next phase will be signaled by where similar activity appears. Based on SentinelLabs’ findings, the highest-risk targets are Pakistani provincial agencies tied to Balochistan, border security, energy infrastructure, ports, transport corridors, and counterterrorism. That is not a prediction pulled from thin air. It follows from the reported motive set: Chinese concern over personnel and infrastructure security, Indian interest in Pakistan’s internal security posture, and the intelligence value of law enforcement data in a contested province.

The evidence that would strengthen this thesis is specific:

• Repeated targeting of provincial police portals, especially complaint, personnel, tenant, hotel, and biometric systems.
• Credential theft involving staff-side interfaces for law enforcement applications.
• Malware on public-facing portals used by both officers and civilians.
• Overlap between state-linked campaigns inside the same provincial or municipal environments.
• Selective leaks or altered records, which would mark a more dangerous turn from espionage toward disruption or influence.

The evidence that would weaken it would be equally concrete: rapid disclosure, clean forensic timelines, stronger segmentation, confirmed containment, and no recurring infrastructure contact across related police systems.

For now, the Balochistan Police hack points in one direction. Regional cyber competition is moving closer to civilians, local institutions, and police databases because that is where actionable intelligence now lives. If Pakistan’s federal and provincial agencies do not defend those systems as national-security assets, rival powers will keep treating them as collection platforms.

Impact Analysis

• Sensitive police data in Balochistan could reveal how Pakistan monitors insurgency, identity records, and internal threats.
• The same provincial force attracting China-linked and India-linked hackers shows how local law enforcement systems can become geopolitical intelligence targets.
• The breach highlights Pakistan’s vulnerability when critical security data is valuable to rival regional powers and insufficiently protected.