# China-Nexus and India-Nexus Espionage Groups Converge on Pakistani Law Enforcement Digitalization Platforms ("One Target, Two Flags")

> SentinelOne Labs documents two independent, unrelated cyberespionage campaigns converging on Pakistani law enforcement between February 2024 and April 2026: China-nexus clusters deploying PlugX, ShadowPad, and Cobalt Strike, and the India-nexus actor TAG-179 (Mysterious Elephant / APT-C-08 / Bitter) deploying Remcos, both targeting Balochistan Police's Complaint Management System (CMS) and related digitalization infrastructure.

- **Published:** 2026-09-05T00:00:00Z
- **Last reviewed:** 2026-09-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2343
- **ID:** TL-2026-2343
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** TAG-179 (China, India)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SentinelOne Labs' "One Target: China, India Espionage Converge on Pakistani Law Enforcement" (published 2026-07-09) documents sustained, independently operated cyberespionage activity by China-nexus and India-nexus actors against Pakistani law enforcement digitalization platforms, primarily the Balochistan Police. Rather than a single coordinated campaign, the report identifies four distinct, temporally bounded malware clusters converging on the same victim set: a PlugX cluster (27 Feb 2024 - 28 Sep 2024), a ShadowPad cluster (5 Nov 2024 - 29 Nov 2024), and a Cobalt Strike cluster (12 Oct 2024 - 5 Dec 2025) attributed with medium confidence to China-nexus operators, plus a Remcos-based campaign (13 Jan 2026 - 9 Apr 2026) attributed to the India-nexus actor TAG-179 (tracked by Recorded Future, overlapping with Kaspersky's 'Mysterious Elephant' and Qihoo 360's APT-C-08/Bitter).

The China-nexus operators are assessed to be independently validating physical/operational security for Chinese nationals and interests in Balochistan against separatist threats (notably Baloch Liberation Army-aligned militancy), rather than acting on behalf of, or coordinating with, Pakistani state security services. Their principal foothold was the Balochistan Police Complaint Management System (CMS) at cms.balochistanpolice.gov.pk: two `cms_plugin.exe` implant variants were staged in the web-accessible `/client scripts/` directory and served to CMS visitors via a fake 'Update Complete! Please refresh the page' portal-update prompt. A Rust-compiled stager variant retrieved a second-stage payload from a Cobalt Strike C2 (193.42.25.65); a .NET variant masqueraded as a Qihoo 360 security component ('360Safe.exe') and reflectively loaded an embedded AsyncRAT assembly configured to beacon to 41.216.188.140. Developer artifacts in the .NET implant -- a `D:\codedome\` build-path prefix, simplified-Chinese log strings, and the pinyin term 'xinshi' (新式, 'new variant') in a PDB path -- indicate a Chinese-speaking developer, corroborating the China-nexus attribution independent of the PlugX/ShadowPad/Cobalt Strike victimology overlap.

The India-nexus actor TAG-179/Bitter pursued a separate, later intrusion into the same CMS ecosystem using a decoy document masquerading as an internal 'operational plan for repatriation of illegal foreigners' referencing Afghan Citizen Card (ACC) holders and coordination between district police, NADRA, and Pakistani intelligence bodies -- a lure plausible enough to match genuine Balochistan law enforcement business, and consistent with Bitter's established South Asian government/foreign-affairs targeting profile and its history of RTF/phishing-delivered custom backdoors communicating over RPC. TAG-179's payload in this campaign was a Remcos RAT configured to a dedicated C2 at 89.31.121.220, active 13 Jan - 9 Apr 2026, overlapping the tail of the China-nexus Cobalt Strike cluster but with no observed coordination or infrastructure sharing between the two nation-state clusters.

Beyond Balochistan Police, SentinelOne names three additional Pakistani law-enforcement/government digitalization targets sharing the same threat model -- Khyber Pakhtunkhwa Police, Islamabad Police, and the Punjab Safe Cities Authority -- though the report provides victimology naming only, without cluster-specific malware, dates, or data-exposure detail for those three. The core structural finding is that Pakistan's 'Smart Police Station' digitalization push, which unified citizen-facing and internal-operations systems (Complaint Management, First Information Report/FIR case files, HR Management Information System personnel and payroll records, Criminal Record Management System biometric fingerprint data, Anti-Vehicle Lifting System stolen-vehicle investigation data, HotelEye NADRA-linked guest logs, and the Tenant Registration System's landlord/tenant-criminal-record integration) onto a small set of internet-facing web applications, inadvertently created a single high-value espionage target whose compromise threatens both institutional operations (officer records, case files, biometric databases) and civilian safety (citizens who filed complaints or used the platforms, whose device access was exposed by the same implants).

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 User Execution: Malicious File
- T1036 Masquerading
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1583.004 Acquire Infrastructure: Server
- T1588.001 Obtain Capabilities: Malware
- T1584.004 Compromise Infrastructure: Server

## Sources

- [One Target: China, India Espionage Converge on Pakistani Law Enforcement](https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement/)
- [APT-K-47 "Mysterious Elephant", a new APT organization in South Asia](https://medium.com/@knownsec404team/apt-k-47-mysterious-elephant-a-new-apt-organization-in-south-asia-5c66f954477)
- [Mysterious Elephant APT: TTPs and tools](https://securelist.com/mysterious-elephant-apt-ttps-and-tools/117596/)
- [TAG-179 actor profile](https://www.mallory.ai/actors/019f4722-ab69-7b30-8ff7-ca582ee538ac)
- [South Asia's Emerging Threat: APT 'Mysterious Elephant' Insights by Knownsec 404 & Kaspersky](https://www.anvilogic.com/threat-reports/south-asia-apt-mysterious-elephant)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2343