SentinelLabs Maps Parallel China-India Intrusions Into Balochistan Police Biometric and Case Systems
Chinese and Indian operators ran concurrent espionage campaigns against Balochistan Police networks for over two years, accessing biometric and case data. The overlap exposes self-interested collection priorities that mainstream coverage has not connected. Evidence rests on malware clustering and regional threat reporting rather than state attribution.
SentinelLabs clustered the activity by shared infrastructure and code reuse rather than single-operator attribution. PlugX and ShadowPad samples align with documented Chinese toolsets used in South Asia, while Remcos traces to one tracked operator. Commodity Cobalt Strike beacons complicate clustering but still show repeated staging on Pakistani law enforcement hosts. The intrusions coincide with Chinese nationals on Belt and Road projects facing Baloch militant attacks, giving Beijing a direct view of Islamabad’s protection failures.
Indian-linked activity fits longstanding New Delhi interest in Balochistan insurgency data. Pakistan has accused India of supporting separatists; the police networks contain personnel records and case files that could reveal Islamabad’s operational posture. No public technical attribution from either government has appeared, leaving the overlap visible only through third-party telemetry.
The dual presence on the same target reveals a rare convergence of rival espionage priorities rather than coordinated action. Mainstream reporting has treated Chinese and Indian regional campaigns as separate tracks; the SentinelLabs clusters show simultaneous collection against one police force without evidence of interference between the actors.
Next steps include deeper infrastructure mapping of the Complaint Management System watering-hole and monitoring for new loaders after April 2026. Contract records for Pakistani police IT upgrades remain the clearest open indicator of remediation timelines.
SentinelLabs: Two additional clusters will receive distinct APT attributions once infrastructure overlap exceeds 15 domains by December 2026.
Sources (3)
- [1]SentinelLabs Report on Pakistan Police Intrusions(https://www.sentinelone.com/labs/)
- [2]Recorded Future South Asia Threat Activity 2024-2025(https://www.recordedfuture.com/)
- [3]SecurityWeek Coverage of Dual Targeting(https://www.securityweek.com/china-india-linked-hackers-both-targeted-same-pakistani-police-force/)