Multi-APT Groups Weaponized a Government Login Portal for Two Years — Audit Yours Now

What Happened

Cybersecurity researchers have published details of a sustained, multi-group espionage campaign that ran from February 2024 through April 2026 — over two years — against Pakistani law enforcement organizations, with the Balochistan Police portal as a central compromise point. According to The Hacker News, suspected China- and India-aligned threat actors operated simultaneously and independently against the same targets, a relatively rare overlap that signals high intelligence value in the targeted data.

The defining detail is in the word weaponize: the portal itself was turned into an offensive asset — most likely a watering-hole or credential-harvesting point — meaning anyone who interacted with what appeared to be a legitimate government login page was potentially exposed. The campaign wasn't a smash-and-grab; it was a quiet, long-running operation that persisted across two calendar years without triggering a public disclosure until now.

Why It Matters

For defenders outside Pakistan, the threat model is transferable. The techniques that kept two separate APT groups embedded in government web infrastructure for 26 months are not geographically constrained:

• Public-facing login portals are high-value pivot points. A compromised portal doesn't just harvest the credentials of the people who log in — it can be modified to serve malicious payloads to every visitor, including journalists, researchers, and foreign government contacts who would never appear on an attacker's primary target list.
• Simultaneous multi-actor compromise is increasingly common. When two threat groups occupy the same network independently, it usually means the initial access was through a soft target — an unpatched CMS, a reused credential, a misconfigured server — that both groups exploited separately rather than one handing off access to the other.
• Two years of dwell time means detection gaps, not just patching gaps. If this persisted from early 2024 to mid-2026, standard signature-based detection and periodic audits clearly didn't catch it. Behavioral anomaly monitoring and regular integrity checks on login page assets are what would have flagged it sooner.

What To Do

If you operate any public-facing web portal — government, enterprise, or SaaS — treat this as a checklist prompt:

1. Verify the integrity of your login pages today. Compare current HTML/JS against a known-good baseline. Attackers insert skimmers and credential-capture scripts into login forms; a file hash diff will catch it.
2. Review your third-party script inventory. Any external JS loaded on an authentication page is a potential injection point. Audit <script src> tags and enforce a strict Content Security Policy.
3. Pull 90 days of web server access logs and look for unusual admin-path access patterns. Persistent implants leave traces in access logs even when they're otherwise quiet.
4. Enable MFA on every administrative account that can modify portal content or server configuration. Credential harvesting only pays off if stolen passwords are sufficient to log in.
5. If you run a CMS or portal software, check for pending security updates now. Multi-group compromise often starts with a known-but-unpatched CVE that multiple threat actors are actively scanning for.

The researchers have not published full indicators of compromise at the time of writing, so watch the original report for updates — IOC releases typically follow the initial disclosure within days.