China and India Independently Breached Balochistan Police Systems Over Two Years

The China-linked cluster deployed PlugX and ShadowPad backdoors via a trojanized portal update on the public-facing Complaint Management System. Forensic artifacts included Chinese-language strings and developer traces. Access focused on CPEC worker threat data following the March and October 2024 attacks. The India-linked cluster, tracked as TAG-179 and overlapping Bitter, used repatriation-themed lures with lower-confidence attribution, targeting insurgency-related records.

Evidence shows no operational linkage between the clusters despite shared victims and timeframes. Victimology aligns with documented patterns: Chinese groups prioritizing overseas citizen protection in Belt and Road corridors, Indian clusters monitoring Balochistan Liberation Army activity amid mutual proxy accusations. Pakistan's ongoing digitization of police records, including European-supported modernization, concentrates high-value data in single repositories.

Centralization creates persistent intelligence targets. Both actors will likely sustain collection on the same systems rather than deconflict, as centralized biometric and complaint data offers direct insight into separatist networks and foreign national movements without reliance on Pakistani assurances.