China-Nexus and India-Nexus Espionage Groups Converge on Pakistani Law Enforcement Digitalization Platforms ("One Target, Two Flags")

Key facts for One Target Two Flags espionage

Detection coverage for One Target Two Flags espionage

As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2343 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CMS Fake-Update Watering-Hole Payload Delivery (cms_plugin.exe)

Detects delivery and execution of cms_plugin.exe / 360Safe.exe-named payloads staged in web-accessible '/client scripts/' style directories on citizen-facing law-enforcement portals, served via a fake 'Update Complete! Please refresh the page' prompt. Matches the China-nexus watering-hole vector used against cms.balochistanpolice.gov.pk and applicable to sibling Smart Police Station platforms (KP Police, Islamabad Police, Punjab Safe Cities).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1204.002, T1036
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval fname=lower(Image)
| where match(fname, "cms_plugin\.exe$") OR match(fname, "360safe\.exe$")
| eval sha1_hit=if(match(lower(Hashes), "sha1=23f6781919a50b118d8d4e6a7e9ae63b71ecc885|sha1=4039454c9189e64285e93fc075a30b93f814b5b5|sha1=58cb2d95063b9df807b7aa8dc106b74ce988a491"), 1, 0)
| eval parent=lower(ParentImage)
| where match(parent, "chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|explorer\.exe") OR sha1_hit=1
| table _time, ComputerName, User, Image, ParentImage, CommandLine, Hashes, sha1_hit
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cms_plugin.exe", "360Safe.exe")
| extend KnownHash = SHA1 in~ ("23f6781919a50b118d8d4e6a7e9ae63b71ecc885","4039454c9189e64285e93fc075a30b93f814b5b5","58cb2d95063b9df807b7aa8dc106b74ce988a491")
| extend BrowserDownload = InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","iexplore.exe")
| where KnownHash or BrowserDownload
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, SHA1, ProcessCommandLine

Sigma

title: CMS Fake-Update Watering-Hole Payload Execution (cms_plugin.exe / 360Safe.exe)
id: 7f3a1c4e-9b02-4a11-8c3e-1a2f5d6b7c81
status: experimental
description: Detects execution of cms_plugin.exe or a masquerading 360Safe.exe binary, matching the fake 'Update Complete' watering-hole lure staged on compromised Pakistani law-enforcement CMS web portals.
references:
    - https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-05
tags:
    - attack.initial-access
    - attack.t1566
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
    - attack.tool.cobalt_strike
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith:
            - '\cms_plugin.exe'
            - '\360Safe.exe'
    selection_hash:
        Hashes|contains:
            - '23F6781919A50B118D8D4E6A7E9AE63B71ECC885'
            - '4039454C9189E64285E93FC075A30B93F814B5B5'
            - '58CB2D95063B9DF807B7AA8DC106B74CE988A491'
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
    condition: selection_name and (selection_hash or selection_parent)
falsepositives:
    - Legitimate Qihoo 360 security software installations (verify code signature and publisher before alerting)
level: high

Known false positives:

• Legitimate Qihoo 360 (360Safe) security software installed by IT — verify Authenticode signature and installer source before escalating

Tuning notes: Scope to hosts that have browsed cms.balochistanpolice.gov.pk or sibling Smart Police Station portals (KP Police, Islamabad Police, Punjab Safe Cities) in the prior 24h via proxy logs; whitelist known-good 360Safe.exe hashes signed by Qihoo 360 if the product is legitimately deployed in the environment.

• 🔒 Executable Delivered from Web-Root '/client scripts/' Path on Law-Enforcement Portal · unlock with TL Creds
• 🔒 Second-Stage Payload Retrieval by Rust-Compiled Stager to Cobalt Strike C2 · unlock with TL Creds
• 🔒 TAG-179 Remcos C2 Beacon Following Repatriation-Lure Document Execution · unlock with TL Creds
• 🔒 Chinese-Developer Build-Artifact Signature in Implant PDB Path · unlock with TL Creds
• 🔒 PlugX/ShadowPad Cluster Activity Window Correlation on Law-Enforcement Hosts · unlock with TL Creds
• 🔒 Sibling DDNS/Open-Directory C2 Staging Pattern (Community-Corroborated Remcos/AsyncRAT/Cobalt Strike Infrastructure) · unlock with TL Creds
• 🔒 Reflective AsyncRAT Assembly Load from Masquerading 360Safe.exe / PlugX-ShadowPad Sideload Chain · unlock with TL Creds
• 🔒 C2 Beaconing to PlugX / ShadowPad / Cobalt Strike / Remcos / AsyncRAT Infrastructure · unlock with TL Creds

Indicators of compromise for One Target Two Flags espionage

As of 2026-09-05, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-2343.

Sample indicators (3 of 33)

• IP address: 172.111.233[.]36
• Domain: cms[.]balochistanpolice[.]gov[.]pk
• File hash: 23f6781919a50b118d8d4e6a7e9ae63b71ecc885

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

How One Target Two Flags espionage works

SentinelOne Labs' "One Target: China, India Espionage Converge on Pakistani Law Enforcement" (published 2026-07-09) documents sustained, independently operated cyberespionage activity by China-nexus and India-nexus actors against Pakistani law enforcement digitalization platforms, primarily the Balochistan Police. Rather than a single coordinated campaign, the report identifies four distinct, temporally bounded malware clusters converging on the same victim set: a PlugX cluster (27 Feb 2024 - 28 Sep 2024), a ShadowPad cluster (5 Nov 2024 - 29 Nov 2024), and a Cobalt Strike cluster (12 Oct 2024 - 5 Dec 2025) attributed with medium confidence to China-nexus operators, plus a Remcos-based campaign (13 Jan 2026 - 9 Apr 2026) attributed to the India-nexus actor TAG-179 (tracked by Recorded Future, overlapping with Kaspersky's 'Mysterious Elephant' and Qihoo 360's APT-C-08/Bitter).

The China-nexus operators are assessed to be independently validating physical/operational security for Chinese nationals and interests in Balochistan against separatist threats (notably Baloch Liberation Army-aligned militancy), rather than acting on behalf of, or coordinating with, Pakistani state security services. Their principal foothold was the Balochistan Police Complaint Management System (CMS) at cms.balochistanpolice.gov.pk: two `cms_plugin.exe` implant variants were staged in the web-accessible `/client scripts/` directory and served to CMS visitors via a fake 'Update Complete! Please refresh the page' portal-update prompt. A Rust-compiled stager variant retrieved a second-stage payload from a Cobalt Strike C2 (193.42.25.65); a .NET variant masqueraded as a Qihoo 360 security component ('360Safe.exe') and reflectively loaded an embedded AsyncRAT assembly configured to beacon to 41.216.188.140. Developer artifacts in the .NET implant -- a `D:\codedome\` build-path prefix, simplified-Chinese log strings, and the pinyin term 'xinshi' (新式, 'new variant') in a PDB path -- indicate a Chinese-speaking developer, corroborating the China-nexus attribution independent of the PlugX/ShadowPad/Cobalt Strike victimology overlap.

The India-nexus actor TAG-179/Bitter pursued a separate, later intrusion into the same CMS ecosystem using a decoy document masquerading as an internal 'operational plan for repatriation of illegal foreigners' referencing Afghan Citizen Card (ACC) holders and coordination between district police, NADRA, and Pakistani intelligence bodies -- a lure plausible enough to match genuine Balochistan law enforcement business, and consistent with Bitter's established South Asian government/foreign-affairs targeting profile and its history of RTF/phishing-delivered custom backdoors communicating over RPC. TAG-179's payload in this campaign was a Remcos RAT configured to a dedicated C2 at 89.31.121.220, active 13 Jan - 9 Apr 2026, overlapping the tail of the China-nexus Cobalt Strike cluster but with no observed coordination or infrastructure sharing between the two nation-state clusters.

Beyond Balochistan Police, SentinelOne names three additional Pakistani law-enforcement/government digitalization targets sharing the same threat model -- Khyber Pakhtunkhwa Police, Islamabad Police, and the Punjab Safe Cities Authority -- though the report provides victimology naming only, without cluster-specific malware, dates, or data-exposure detail for those three. The core structural finding is that Pakistan's 'Smart Police Station' digitalization push, which unified citizen-facing and internal-operations systems (Complaint Management, First Information Report/FIR case files, HR Management Information System personnel and payroll records, Criminal Record Management System biometric fingerprint data, Anti-Vehicle Lifting System stolen-vehicle investigation data, HotelEye NADRA-linked guest logs, and the Tenant Registration System's landlord/tenant-criminal-record integration) onto a small set of internet-facing web applications, inadvertently created a single high-value espionage target whose compromise threatens both institutional operations (officer records, case files, biometric databases) and civilian safety (citizens who filed complaints or used the platforms, whose device access was exposed by the same implants).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1620 Reflective Code Loading

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools

Execution

T1204.002 User Execution: Malicious File

Initial Access

T1566 Phishing

Resource Development

T1583.004 Acquire Infrastructure: Server; T1584.004 Compromise Infrastructure: Server; T1588.001 Obtain Capabilities: Malware

Remediation for One Target Two Flags espionage

Immediate actions

• Block all listed C2 IP addresses (172.111.233.36/.96/.12/.105/.26, 172.94.9.49/.43/.19, 45.74.6.17, 45.125.32.218, 142.171.183.8, 193.42.25.65, 89.31.121.220, 41.216.188.140) at network perimeter and DNS/egress filtering layers
• Remove cms_plugin.exe and any 360Safe.exe-named binaries from web-accessible directories on cms.balochistanpolice.gov.pk and sibling police web applications (FIR, HRMIS, CRMS, AVLS, HotelEye, TRS)
• Audit '/client scripts/' and equivalent web-root subdirectories on all Pakistani law-enforcement digitalization platforms for unauthorized executables masquerading as update prompts
• Hunt for the listed SHA-1 hashes across endpoint and file-integrity monitoring for Balochistan Police, Khyber Pakhtunkhwa Police, Islamabad Police, and Punjab Safe Cities Authority environments
• Reset credentials and rotate session tokens for any accounts that accessed the compromised CMS portal during the identified activity windows

Workarounds

• Disable or gate direct download of executables from citizen-facing complaint-status portals until integrity controls are in place

Longer-term hardening

• Segment citizen-facing web applications from internal law-enforcement systems (FIR, HRMIS, CRMS) so a public-portal compromise cannot pivot to personnel or biometric databases
• Deploy EDR with behavioral detection across all Smart Police Station digitalization infrastructure, not just internet-facing web servers
• Establish code-signing and integrity verification for any executable served from a government web portal to prevent fake-update-prompt delivery
• Conduct a security architecture review of the Smart Police Station digitalization program given the demonstrated value of centralized citizen+institutional data as a single collection target

Affected and fixed versions

• Balochistan Police — Complaint Management System (CMS)
  Vulnerable versions: cms.balochistanpolice.gov.pk, all versions as of the Feb 2024-Apr 2026 activity window
• Balochistan Police — First Information Report (FIR) system
  Vulnerable versions: as deployed under the Smart Police Station digitalization program
• Balochistan Police — Human Resource Management Information System (HRMIS)
  Vulnerable versions: as deployed under the Smart Police Station digitalization program
• Balochistan Police — Criminal Record Management System (CRMS)
  Vulnerable versions: as deployed under the Smart Police Station digitalization program
• Balochistan Police — Anti-Vehicle Lifting System (AVLS)
  Vulnerable versions: as deployed under the Smart Police Station digitalization program
• Balochistan Police — HotelEye guest check-in system
  Vulnerable versions: as deployed under the Smart Police Station digitalization program, NADRA-integrated
• Balochistan Police — Tenant Registration System (TRS)
  Vulnerable versions: as deployed under the Smart Police Station digitalization program
• Government of Pakistan — Khyber Pakhtunkhwa Police digitalization platforms
  Vulnerable versions: named as sharing the same threat model; no cluster-specific detail published
• Government of Pakistan — Islamabad Police digitalization platforms
  Vulnerable versions: named as sharing the same threat model; no cluster-specific detail published
• Government of Pakistan — Punjab Safe Cities Authority platforms
  Vulnerable versions: named as sharing the same threat model; no cluster-specific detail published

Timeline of One Target Two Flags espionage

• 2024-02-27 China-nexus locked-ioc-33 cluster activity against Pakistani law enforcement infrastructure first observed
• 2024-09-28 locked-ioc-33 cluster activity window closes
• 2024-10-12 China-nexus locked-ioc-23 cluster activity begins, overlapping the tail of the locked-ioc-33 window
• 2024-11-05 China-nexus locked-ioc-30 cluster activity observed
• 2024-11-29 locked-ioc-30 cluster activity window closes
• 2025-12-05 China-nexus locked-ioc-23 cluster activity window closes
• 2026-01-13 India-nexus TAG-179 (Bitter/Mysterious Elephant/APT-C-08) locked-ioc-32 campaign against Balochistan Police begins
• 2026-04-09 TAG-179 locked-ioc-32 campaign activity window closes
• 2026-07-09 SentinelOne Labs publishes "One Target: China, India Espionage Converge on Pakistani Law Enforcement," detailing both independent campaigns

Sources cited for One Target Two Flags espionage

• Mysterious Elephant APT: TTPs and tools Kaspersky Securelist · Research
• TAG-179 actor profile mallory.ai · Research
• South Asia's Emerging Threat: APT 'Mysterious Elephant' Insights by Knownsec 404 & Kaspersky anvilogic.com · Research
• One Target: China, India Espionage Converge on Pakistani Law Enforcement SentinelOne · Blog · 2026-07-09
• APT-K-47 "Mysterious Elephant", a new APT organization in South Asia medium.com · Blog · 2023-08-16

More in apt

• ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
• APT SideWinder Domain Infrastructure Targeting South Asian Governments (CVE-2017-0199 Weaponized Documents)
• Suspected APT37 Python Backdoor Delivered via AI Deepfake Impersonation Spear-Phishing Campaign
• MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns Targeting the Middle East and Global Organizations
• CISA AA26-194A: Russian State-Sponsored (FSB Center 16) Exploitation of Misconfigured Cisco Routers via SNMP and Smart Install (CVE-2018-0171, CVE-2008-4128)

Related coverage of this activity

• Balochistan Police CMS implant