Balochistan Police Portal Espionage: Detection and Hardening Against Nation-State Web Attacks

Between February 2024 and April 2026, cybersecurity researchers uncovered sustained cyber espionage operations targeting Pakistani law enforcement agencies, specifically centering on the Balochistan Police. Suspected China- and India-aligned threat actors have successfully weaponized the Balochistan Police web portal to harvest sensitive data.

This is not a theoretical exercise. The compromise involves servers hosting web applications that manage critical police and citizen data, including criminal records and personally identifiable information (PII). For defenders, this campaign serves as a stark reminder: public-facing portals remain the primary entry point for nation-state actors looking to infiltrate government networks. The urgency is compounded by the operational security risk—exposing informant networks and ongoing investigations.

Technical Analysis

While the specific CVE has not been publicly disclosed in this report, the attack vector is clearly identified as the exploitation of the Balochistan Police web portal. The threat actors leveraged vulnerabilities in the web application to gain initial access, likely via unpatched services or authentication bypasses.

Affected Assets:

• Platform: Web Servers (Linux/Windows hosting web applications).
• Data: Criminal databases, citizen PII, police operational data.

Attack Chain:

1. Initial Access: Threat actors identified and exploited a vulnerability in the web portal or utilized valid credentials obtained through phishing or brute force.
2. Web Shell Deployment: Upon compromise, web shells were likely uploaded to maintain persistence and facilitate command-and-control (C2) directly from the web server.
3. Privilege Escalation: Attackers moved from the web service context (e.g., www-data) to a higher-privileged user to access sensitive database files.
4. Exfiltration: Data was staged and exfiltrated, likely using encrypted tunneling to blend in with administrative traffic.

Exploitation Status: Confirmed Active Exploitation. This campaign is active as of April 2026.

Detection & Response

Detecting this type of espionage requires visibility into web server process lineage and file system integrity. Standard AV often misses custom web shells. We need to hunt for anomalies: web servers spawning shells, unusual outbound connections from web accounts, and the creation of suspicious script files in web directories.

SIGMA Rules

---
title: Web Server Spawning System Shell
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects web server processes spawning command-line shells (bash, sh, cmd, powershell), a common indicator of web shell activity.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.web_shell
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/apache2'
      - '/nginx'
      - '/httpd'
      - '/java'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate administrative scripts executed by web administrators
level: high
---
title: Suspicious Outbound Connection from Web Service Account
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects outbound network connections initiated by common web service accounts, potentially indicating C2 or data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
    Initiated: 'true'
  filter:
    DestinationPort:
      - 80
      - 443
  condition: selection and not filter
falsepositives:
  - Web server fetching updates or communicating with backend DBs on non-standard ports
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for processes spawned by web services that are indicative of reconnaissance or data exfiltration tools.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~("apache", "nginx", "httpd", "php-cgi", "java", "tomcat")
| where ProcessFileName in~("bash", "sh", "python", "perl", "php", "wget", "curl", "nc", "socat")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, InitiatingProcessId
| order by Timestamp desc

Velociraptor VQL

Hunt for recently modified PHP scripts in web directories, a common signature of web shell uploads.

-- Hunt for PHP files modified in the last 7 days in web roots
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/var/www/html/**/*.php")
WHERE Mtime > now() - 7*24*60*60
ORDER BY Mtime desc

Remediation Script (Bash)

Run this script on suspected compromised Linux web servers to identify common web shell characteristics and recent changes.

#!/bin/bash

echo "[+] Hunting for potential web shells in /var/www/html..."

# Find PHP files created or modified in the last 2 days
find /var/www/html -type f -name "*.php" -mtime -2 -ls

# Check for common web shell strings in PHP files (heuristic)
echo "[+] Scanning for common obfuscation patterns..."
grep -Rl --include="*.php" -E "base64_decode|eval\(|gzinflate|str_rot13|shell_exec|passthru|system\(\$_" /var/www/html 2>/dev/null | head -n 20

# Check for active network connections from web server users
echo "[+] Checking active connections from www-data..."
sudo lsof -u www-data -i -a

echo "[+] Hunt complete. Review findings immediately."

Remediation

Immediate containment and eradication are required if compromise is suspected.

1. Isolate Systems: Immediately disconnect compromised web servers from the network and the internet to stop further exfiltration.
2. Credential Reset: Assume full compromise. Reset all credentials associated with the web portal, database administrators, and service accounts (LDAP/AD).
3. Patch and Upgrade: Apply all pending security updates to the Operating System, Web Server software (Apache/Nginx/IIS), and the underlying CMS or application framework. Review the changelogs for patches related to authentication bypass or file upload vulnerabilities released between 2024 and 2026.
4. Code Review: Conduct a thorough audit of the web application code. Remove any unidentified PHP, ASP, or JSP files found in the web root.
5. Network Segmentation: Ensure web servers are in a DMZ with strict egress filtering. They should not be able to initiate connections to the internet or internal administrative segments except via required jump hosts/proxies.
6. WAF Deployment: Implement or tune a Web Application Firewall (WAF) to block common attack patterns (SQLi, RCE, File Upload) targeting the portal.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub