Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stakes in Pakistan's internal security. Executive Summary SentinelLABS has been tracking sustained cyberespionage activity against several Pakistani law enforcement organizations, taking place from February 2024 to April 2026. All these actors converged on Balochistan Police ov…

https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement

sha256:296c0b4da17ebbedcc353de44f3f3b093ed4f3166a7a9700d0a6f68b2762dc9c

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url0
ipv414
ipv60
sha116
domain3
sha2560
malware_token4
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	172.94.9.43	Open →
ip	172.111.233.36	Open →
ip	172.111.233.96	Open →
ip	172.111.233.105	Open →
ip	172.111.233.26	Open →
ip	172.94.9.49	Open →
ip

Malware families

Allowlist token matches only.

Cobalt Strikemalware-family
AsyncRATmalware-family
PlugXmalware-family
Remcosmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports