Threat Actor 🇮🇳 India

RAZOR TIGER

Also known as: SideWinder · Rattlesnake · APT-C-17 · T-APT-04

An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages.

Indicators of Compromise 5

Domain cms[.]balochistanpolice[.]gov[.]pk Filename 360Safe.exe Filename cms_plugin.exe IP 142[.]171[.]183[.]8 IP 193[.]42[.]25[.]65

MITRE ATT&CK TTPs 1

T1059.001

PowerShell

Execution

Source Articles

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Cyber espionage campaigns targeting Pakistani law enforcement agencies, including the Balochistan Police, have been conducted by suspected China- and India-aligned threat actors between February 2024 and April 2026. The attackers exploited web applications such as the Complaint Management System to deploy custom malware, including PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. These operations targeted sensitive data including biometric records, criminal files, and personnel information, with infrastructure overlaps linking some activity to known threat groups like Mysterious Elephant. The compromise of public-facing portals extended the attack surface to both law enforcement and citizens.

hacker-news ·2w ago