SentinelOne's research reveals that from February 2024 through April 2026, cyberespionage actors linked to both China and India conducted intrusions targeting Pakistani law enforcement networks, primarily the Balochistan Police. The attackers accessed sensitive data repositories such as biometric databases and criminal records. Four malware clusters were identified: PlugX, ShadowPad, Cobalt Strike, and Remcos, with Remcos linked to a single tracked actor. Notably, malicious files masquerading as software updates were deployed on the public Complaint Management System, exposing both police personnel and citizens to compromise. The intrusions align with regional geopolitical conflicts involving Baloch separatist militants and intelligence interests of China and India. The source does not provide details on patches or fixes.

The intrusions compromised sensitive law enforcement data including biometric databases, criminal case files, and personnel records, potentially undermining police operations and citizen privacy. The presence of malware on a public-facing complaint portal risks infection of both police officers and civilians. The espionage activity reflects ongoing regional intelligence conflicts and may facilitate surveillance or influence operations. No evidence of active exploitation in the wild or direct operational disruption is stated.

Patch status is not yet confirmed — check the vendor advisory or SentinelOne updates for current remediation guidance. Organizations should monitor for indicators of compromise related to PlugX, ShadowPad, Cobalt Strike, and Remcos malware families. Given the use of malicious software update prompts on public portals, verifying the integrity of update mechanisms and restricting unauthorized code deployment is recommended. No official fix or vendor advisory is provided in the source.