Pakistan’s government portals, universities, and hospitals spent 2026 under near-constant pressure from state-backed spies on one side and profit-driven criminals on the other. ThreatMon tracked all of it for its Pakistan Cyber Threat Landscape Report 2026, and the numbers underneath the headlines are worth a closer look.
.gov.pk domains.Five distinct pressure points converged on Pakistan this year: espionage campaigns against law enforcement and defense networks, a wave of ransomware against healthcare and finance, dozens of defaced government and university websites, a satellite broadcast hijacking during prime-time news, and a steady bleed of credentials through infostealer malware.
None of it happened in a vacuum. A police complaint portal got turned into a malware host. Leaked university logins fed initial-access brokers on criminal forums. The common thread: attackers went after whichever surface was weakest that week an unpatched server, a phishing document, an infected laptop not necessarily the most “important” one.
Sector Distribution of Web Defacement Incidents
Two very different types of actors were operating side by side.
Chinese state-linked operators and India-aligned groups both ran sustained campaigns against Pakistani law enforcement, with Balochistan Police as a recurring target for both sides China reportedly after intelligence on threats to Chinese nationals and CPEC infrastructure, India after insight into Pakistan’s security posture in the region. SloppyLemming (India-aligned) expanded into telecom and nuclear-adjacent targets using a custom backdoor called BurrowShell. Mustang Panda kept updating its CoolClient toolset against Asian government networks. A cluster tracked as SHADOW-EARTH-053 skipped the need for a zero-day entirely, walking into unpatched Microsoft Exchange servers through the years-old ProxyLogon flaw.
Ransomware operators The Gentlemen, Qilin, DragonForce, NightSpire, APT73, WorldLeaks claimed victims across healthcare, insurance, education, and retail. On underground forums, two aliases, Nicotine and Umbra Community, topped the activity charts with 20 recorded incidents each, ahead of Keymous Plus, Flipperone, and Indian Cyber Mafia.
Who got hit hardest: government agencies, by a wide margin, followed by education (driven partly by a cluster of university defacements tied to Dawood University of Engineering and Technology), then healthcare, telecom, e-commerce, and aviation.
Targeted Sectors Across 5 Pakistan-Focused Campaigns (2026)
There wasn’t a quiet month. Law enforcement espionage campaigns ran January through April. Keymous Plus hit three government websites Foreign Affairs, Defence, and Punjab on the same day, March 17. That same month, a hijacked PAKSAT satellite feed knocked Geo News off air during its evening bulletin. April brought both the SHADOW-EARTH-053 disclosure and a ransomware hit on Beaconhouse School System. By June, a dataset claiming over 30 million Pakistan International Airlines flight records was listed for sale; by July, EFU Life Assurance had joined the ransomware victim list.
Two forces are pulling in the same direction. Geopolitically, Pakistan sits at the intersection of Chinese infrastructure investment (CPEC) and long-running regional tension with India which explains why both countries’ state-aligned actors keep showing up in the same police networks, just with different objectives. Economically, Pakistani organizations hold data that’s cheap to steal and easy to sell: a dataset of nearly two million people’s phone numbers and national ID numbers, pulled from a platform called WEBDOC, was listed for just $600. When the payout is that low-effort, the volume of attempts goes up.
Strip away the branding and most campaigns reused a small, familiar toolkit:
.gov.pk and .edu.pk logins ended up in criminal datasets without those organizations being breached directly.A sample of the kind of indicator ThreatMon tracked through this period (defanged for safety):
| Indicator | Type | Associated Threat |
|---|---|---|
172.111.233[.]36 | IPv4 | PlugX C2 |
45.125.32[.]218 | IPv4 | ShadowPad C2 |
hxxps://cms[.]balochistanpolice[.]gov[.]pk/.../cms_plugin.exe | URL | — |
The infostealer numbers deserve a second look, because they’re easy to misread. Out of ~760,000 Pakistan-linked URLs in stealer logs, .gov.pk accounted for 57.6% and .edu.pk another 27.9% led by fbr.gov.pk (tax authority), punjab.gov.pk, and nadra.gov.pk (national ID database). That doesn’t mean those systems were hacked. It means an employee, student, or citizen logged in from a device that was already compromised, and their session got scooped up along with everything else on it. That’s a much larger, quieter attack surface than any single breach headline, and it’s the one most often missed by traditional security monitoring.
This is the piece ThreatMon’s analysts kept coming back to while building the report: almost none of these incidents required a novel exploit. ProxyLogon is years old. DLL sideloading is a known technique. Infostealer malware is commodity crimeware sold on forums for a few hundred dollars. The sophistication here isn’t in the tools it’s in the patience and the targeting logic, especially on the espionage side, where operators clearly picked systems (complaint portals, biometric databases, personnel records) that pay off over years, not days.
That’s also why continuous dark web and infostealer monitoring matters more than a one-time audit. A leaked NADRA credential or a .gov.pk session cookie sitting in a stealer log today is exactly the kind of thing that turns into an initial-access listing next month, and a ransomware incident the month after that. ThreatMon’s own tracking of underground forums and C2 infrastructure is what surfaced the WEBDOC, PIA, and DGMP listings well before they became public news stories the same visibility gap the report’s roadmap section is built to close, through Zero Trust access controls, mandatory MFA on government and VPN systems, faster patching for internet-facing services, and ongoing credential-exposure monitoring.
From exposed credentials to dark web activity and threat actor infrastructure, nationwide cyber risk requires continuous visibility. Explore ThreatMon National Cyber Defence.
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
