--- title: One Target, Two Flags | Rival Espionage Actors Converge... description: SentinelLABS tracked sustained cyberespionage operations against Pakistani law enforcement organizations from February 2024 to April 2026, finding that both... canonical: https://daily.dev/posts/one-target-two-flags-rival-espionage-actors-converge-on-pakistani-law-enforcement-b15aft9uo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement | daily.dev og:description: SentinelLABS tracked sustained cyberespionage operations against Pakistani law enforcement organizations from February 2024 to April 2026, finding that both... og:url: https://daily.dev/posts/one-target-two-flags-rival-espionage-actors-converge-on-pakistani-law-enforcement-b15aft9uo og:image: https://api.daily.dev/og/posts/b15Aft9UO.png og:image:alt: One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement **[SentinelLABS](https://daily.dev/sources/sentinelone-labs)** · 16 min read · 0 upvotes · 0 comments ## Summary SentinelLABS tracked sustained cyberespionage operations against Pakistani law enforcement organizations from February 2024 to April 2026, finding that both China-nexus and India-nexus threat actors converged on Balochistan Police. China-linked actors deployed PlugX, ShadowPad, and Cobalt Strike implants, likely motivated by concerns over attacks on Chinese nationals tied to CPEC infrastructure. India-linked actor TAG-179 (overlapping with Mysterious Elephant/Bitter) used Remcos, likely seeking intelligence on Pakistan's management of the Baloch insurgency. A China-nexus actor also compromised the Balochistan Police Complaint Management System web application, planting fake update implants (cms_plugin.exe) written in Rust and .NET that targeted both police staff and citizens. The compromised systems held biometric records, criminal case files, personnel data, hotel guest logs, and tenant registrations. The report includes full IOCs including C2 IP addresses, SHA-1 hashes, and malware indicators. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Chinese spy group caught lurking in Poland, Asia networks](https://daily.dev/posts/chinese-spy-group-caught-lurking-in-poland-asia-networks-9camnlgtt) · The Register · 1 upvotes · 0 comments - [Chinese Nexus Actors Shift Focus to Qatar Amid Iranian Conflict](https://daily.dev/posts/chinese-nexus-actors-shift-focus-to-qatar-amid-iranian-conflict-5ypto6grv) · Dark Reading · 0 upvotes · 0 comments - [China-nexus Threat Actor Targets Persian Gulf Region With PlugX](https://daily.dev/posts/china-nexus-threat-actor-targets-persian-gulf-region-with-plugx-3amxlgbpx) · Security Boulevard · 0 upvotes · 0 comments - [Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia](https://daily.dev/posts/suspected-china-based-espionage-operation-against-military-targets-in-southeast-asia-gqascxcy9) · Unit 42 · 0 upvotes · 0 comments - [2025: The Untold Stories of Check Point Research](https://daily.dev/posts/2025-the-untold-stories-of-check-point-research-hnmpyhdaz) · Check Point Research · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/one-target-two-flags-rival-espionage-actors-converge-on-pakistani-law-enforcement-b15aft9uo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement","url":"https://daily.dev/posts/one-target-two-flags-rival-espionage-actors-converge-on-pakistani-law-enforcement-b15aft9uo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/one-target-two-flags-rival-espionage-actors-converge-on-pakistani-law-enforcement-b15aft9uo"},"datePublished":"2026-07-09T12:57:30.410Z","dateModified":"2026-07-09T12:57:59.967Z","description":"SentinelLABS tracked sustained cyberespionage operations against Pakistani law enforcement organizations from February 2024 to April 2026, finding that both...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e16219f4b3012e4a86c6445c80cff98a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e16219f4b3012e4a86c6445c80cff98a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SentinelLABS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SentinelLABS","logo":"https://media.daily.dev/image/upload/s--BzJ1lEiU--/f_auto,q_auto/v1780213258/logos/sentinelone-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/sentinelone-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/one-target-two-flags-rival-espionage-actors-converge-on-pakistani-law-enforcement-b15aft9uo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SentinelLABS","item":"https://daily.dev/sources/sentinelone-labs"},{"@type":"ListItem","position":3,"name":"One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement"}]} ```