Balochistan Police Portal: A Case Study in Multi-Actor Espionage
Just caught the latest report on the Balochistan Police portal compromise. It’s a textbook example of how threat actors from different geopolitical alignments (suspected China- and India-aligned groups) will exploit the same gaping holes. Between Feb 2024 and April 2026, these groups didn't just snoop; they weaponized the web servers hosting police and citizen data.
The attackers seemed to leverage unpatched vulnerabilities in the portal's web application layer to drop web shells. Once inside, they had access to criminal records and citizen PII. What stands out is the persistence; this wasn't a smash-and-grab but a sustained campaign.
For those running IIS or Apache stacks in similar sectors, checking for anomalous file creation in web directories is critical. Here’s a quick KQL query for Microsoft Sentinel to hunt for recently added suspicious extensions in inetpub:
DeviceFileEvents
| where FolderPath contains "inetpub" or FolderPath contains "wwwroot"
| where FileName endswith ".aspx" or FileName endswith ".php" or FileName endswith ".ashx"
| where InitiatingProcessFileName !in_("w3wp.exe", "httpd.exe", "services.exe")
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, SHA256
The double-whammy here is the operational security failure: having two separate APT groups in the same network simultaneously suggests basic segmentation was missing.
Discussion: With legacy law enforcement portals often stuck on deprecated stacks, is network micro-segmentation the only viable defense, or are we seeing any success with virtual patching via WAFs in these government sectors?
Virtual patching is a band-aid. In our pentests of local gov infrastructure, we find they rely on the WAF but have internal services listening on loopback that aren't filtered. If an attacker gets that web shell, they pivot internally instantly. You have to assume the WAF fails and enforce Zero Trust.
Double-compromises are becoming the norm. We investigated a power utility last year where two distinct groups were using the same exposed SolarWinds instance. It’s crazy how much 'island hopping' we see now. The KQL query is great, but don't forget to correlate it with NetworkConnectionEvents to catch the C2 beacons immediately.
The sheer persistence of these actors is alarming. In similar cases involving government portals, I've seen them stash web shells within legitimate upload directories to evade simple file integrity checks. When auditing, pay close attention to double extensions or content mismatches there. You can hunt for these quickly with:
find /var/www/html/uploads -type f -name "*.jpg" -exec file {} \; | grep -i "PHP script"
Anyone check if these shells used custom C2 protocols or standard ones like Godzilla?
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access