Attack Chain

1. Initial Access: Threat actors gain access to externally facing web applications (e.g., Complaint Management System) and network appliances belonging to Pakistani law enforcement.
2. Deployment: China-nexus actors deployed custom implants masquerading as legitimate portal updates within compromised web applications.
3. Execution: Malicious implants are executed on the compromised servers or workstations, establishing an initial foothold within the victim environment.
4. Command and Control: Post-exploitation tools like PlugX, ShadowPad, Cobalt Strike, and Remcos communicate with external command and control (C2) servers over network connections (e.g., 172.111.233.36, 45.125.32.218).
5. Collection: Threat actors accessed and collected sensitive data from compromised servers, including criminal records, biometric information, hotel and tenant registrations, and personnel data.
6. Exfiltration: Collected sensitive data is transferred from the compromised networks to attacker-controlled C2 infrastructure via established communication channels.
7. Persistence: Implants and other malicious components are maintained on compromised systems, ensuring sustained access for long-term espionage objectives.

Impact

The intrusions resulted in the compromise of servers hosting critical web applications managing police and citizen data, including criminal and biometric records, hotel and tenant registrations linked to national identity records, and personnel files. Law enforcement organizations in Balochistan, Khyber Pakhtunkhwa, Islamabad, and Punjab were confirmed as affected targets. The compromise of a Complaint Management System by China-nexus actors put both police staff and citizens' data at risk. The primary impact is the loss of sensitive internal security intelligence for Pakistan and potential privacy breaches for citizens, fueling China's independent assessment of security risks to its nationals and providing India with insights into Pakistan's security posture.

Recommendation

• Deploy the Sigma rule "Detect Outbound Network Connections to Known Espionage C2 IPs" in this brief to your SIEM and tune for your environment.
• Block the C2 IP addresses (e.g., 172.111.233.36, 45.125.32.218, 142.171.183.8, 89.31.121.220) listed in the IOC table at the network perimeter or firewall.
• Implement robust security controls and regular patching for all externally-facing web applications, especially those managing sensitive data like the Complaint Management System.
• Conduct regular integrity checks and threat hunting on web application files and associated directories to detect unauthorized modifications or masqueraded updates.
• Monitor network traffic for outbound connections to suspicious IP addresses and known C2 infrastructure associated with PlugX, ShadowPad, Cobalt Strike, and Remcos.