Suspected Chinese State-Linked Hackers Spying On 'All-Weather Friend' Pakistan

Suspected Chinese state-linked hackers have been carrying out digital espionage on Pakistan, which Beijing refers to as its "iron-clad brother" and "all-weather friend". The aim is to obtain information related to its internal security and development plans.

According to US cyber threat intelligence firm SentinelLabs, Chinese hackers carried out intrusions into the digital infrastructure of the police forces of Balochistan, Khyber Pakhtunkhwa, and Islamabad.

They also targeted the Punjab Safe Cities Authority, which is mandated with maintaining an Integrated Command, Control, and Communication system across the Pakistani province to transform public safety and urban policing.

The China-linked cyber threat actors deployed sophisticated malware families, PlugX, ShadowPad, Cobalt Strike to infiltrate Pakistan's digital infrastructure and steal valuable data, SentinelLabs said based on the analysis of command and control netflow data.

The report also states that suspected India-linked hackers also targeted Balochistan Police, but Indian hackers targeting a Pakistani agency is hardly a surprise. The arch enemies continuously target each other's digital assets for intelligence inputs. 

As per SentinelLabs, the affected Pakistani digital assets spanned network appliances and servers hosting web applications that manage biometric records, hotel and tenant registrations linked to national identity records, criminal case files, and personnel records. 

A suspected China-linked hacking group infiltrated the Balochistan Police's web applications by disguising malware as a routine portal update. Because the platform serves both police personnel and the general public, the breach exposed both groups to the attackers.

"PlugX and ShadowPad point to China-nexus cyberespionage groups on the basis of the tooling itself, since both are backdoors shared among multiple such groups," the report said. 

The victims of PlugX and ShadowPad malware families through 2024 further point to Chinese hackers. Apart from the Pakistani authorities, they also targeted government, foreign affairs, defence, nongovernmental, and research entities across South, Southeast, Central, and East Asia, the Arabian Peninsula, and Southeast Europe, consistent with China-aligned collection.

Chinese cyber attacks against the Balochistan Police are likely motivated by Beijing's willingness to gain first-hand insights into Pakistan's internal security in order to protect Chinese workers executing the projects under the Pakistan-China Economic Corridor (CPEC). China has publicly expressed dissatisfaction over attacks on Chinese citizens in Pakistan. 

As per the Pakistani government, at least 20 Chinese workers were killed and 34 others injured in terrorist attacks between 2021 and 2024. 

But this is not the first time Chinese hackers have been caught spying on Pakistan. In 2023, a cybersecurity firm detected that suspected Chinese hackers had infected a crucial Pakistani government app with ShadowPad malware. E-Office is described as "helping the government departments to go paperless".

Databases on cybersecurity firms list Pakistan among the targets of infamous Chinese hacker group Mustang Panda.