Pakistan

This page covers cyber threats to Pakistan. It brings together official Pakistani texts (the national CERT PKCERT, the Ministry of IT and Telecommunication, the National Assembly), US government advisories, MITRE ATT&CK, statements and news reports on major incidents, and Brandefense research.

Threat groups that official sources link to Pakistan

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

Sidewinder: MITRE ATT&CK describes Sidewinder as a suspected Indian threat actor group active since at least 2012. It says the group has been observed targeting government, military and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal and Afghanistan.

Mustang Panda: MITRE ATT&CK says Mustang Panda has targeted government, diplomatic and non-governmental organizations, including think tanks, religious institutions and research entities, across the United States, Europe and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan and Vietnam.

APT38: the US advisory AA20-239A (last revised 24 October 2020) says the North Korean team it calls BeagleBoyz likely targeted financial institutions in a list of nations from 2015 through 2020, and Pakistan is on that list. The advisory says the BeagleBoyz overlap to varying degrees with APT38.

MITRE ATT&CK also describes a group that does not yet have a profile here. It says BITTER, a suspected South Asian espionage group active since at least 2013, has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia.

Incidents on record

The incidents listed below are the major ones that Pakistani and regional media or officials reported widely. Where sources disagree, the incident page says so. Small incidents are not listed.

How attackers target Pakistan: Brandefense research

Our own research mentions Pakistan mostly in posts on South Asian espionage groups. In summary, as our posts report:

Espionage groups that list Pakistan among their targets: our May 2023 APT review covers a Sidewinder campaign against government authorities and individuals in Pakistan and Turkey. It says the campaign hit Pakistan from November 2022 and used polymorphic files, spear-phishing and the Office flaw CVE-2017-0199. The RAZOR TIGER post says the same group targets government, military and business organizations in Asia, mainly Pakistan, China, Nepal and Afghanistan. The Hazy Tiger post describes phishing against Pakistani and Bangladeshi government organizations on military and foreign affairs in 2019 to 2021. The Bitter APT post describes the actors as known for espionage campaigns against China, Pakistan and Saudi Arabia. The Moonlight Tiger post says the Patchwork group focused on Pakistani defense and foreign affairs bodies in 2018 and used the BADNEWS remote access trojan, delivered by phishing emails disguised as academic research papers.

Other espionage groups: the El Machete profile says that by 2022 the group targeted government institutions, energy and finance in Venezuela, Israel, Saudi Arabia and Pakistan, using documents about the war between Ukraine and Russia. The Equation Group profile lists Pakistan among the highly targeted countries.

Groups said to be based in Pakistan: see the APT36 (Transparent Tribe) profile, and our posts on APT36, Mythic Leopard and the Poseidon campaign describe a group that MITRE ATT&CK calls suspected to be Pakistan-based and that mainly targets India. These posts are about threats from Pakistan, not to it.

We found no post on ransomware or banking trojans that mentions Pakistan.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins or card data are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Ministry of IT and Telecommunication lists the National Cyber Security Policy 2021 as approved on 27 July 2021. The policy sets up a Cyber Governance Policy Committee, whose recommendations are approved or endorsed by the Federal Cabinet. It says the policy is reviewed every three years. PKCERT lists the policy next to the Prevention of Electronic Crimes Act 2016, the CERT Rules 2023 and the Electronic Transaction Ordinance 2002.

A 2025 amendment bill to the electronic crimes law, as reported by the National Assembly Standing Committee on Interior, would set up a National Cyber Crime Investigation Agency headed by a Director General. We opened the committee report and not the final gazette text, so we do not state here whether the bill became law.

How incident response is organized

PKCERT, the National Cyber Emergency Response Team, describes itself as a national government entity responsible for protecting the digital assets, sensitive information and critical infrastructure of Pakistan. Its form for reporting incidents covers attacks on organizations, networks, systems and critical infrastructure. It says crimes against individuals, such as online fraud, go elsewhere.

The policy names a National Computer Emergency Response Team and a National Security Operation Center at national level, and sectoral regulators and CERTs for defense, telecom, banking and finance, power and the public sector. The CERT Rules 2023 define the National CERT as a central entity that deals with federal, provincial, sectoral and defense CERTs, and provide for a Critical Information Infrastructure CERT that coordinates between the National CERT and the sectoral CERTs. For banks, the State Bank of Pakistan has instructed all banks to identify and counter cyber threats, as it said in November 2018.

Sectors and rating

The National Cyber Security Policy 2021 says critical information infrastructure generally includes the energy, telecom, finance, water and healthcare sectors. Gulf News reported in October 2021 that the finance minister had told the National Assembly that the tax board’s portals faced about 71,000 cyberattacks a month on average. We found no official Pakistani rating or index figure to quote.

The official sources we opened give no national attack counts. The groups and incidents on this page come from foreign government advisories, MITRE ATT&CK, official statements and news reports. Figures for Pakistan will come from Brandefense Atlas.