Firewalls and Frontlines: The India-Pakistan Cyber Battlefield Crisis

EXECUTIVE SUMMARY

At CYFIRMA, we are committed to offering up-to-date insights into prevalent threats and tactics employed by malicious actors, targeting both organizations and individuals. In early 2025, tensions between India and Pakistan coincided with an unprecedented wave of cyber operations by non-state hacktivist groups triggered by a terrorist attack in Kashmir, and India’s subsequent cross-border retaliation. These operations – often defacements, distributed-denial-of-service (DDoS) attacks, and claimed data breaches – primarily targeted government, defense, and critical infrastructure networks. Although many proved to have limited impact, the intensity and visibility of these cyber campaigns added a volatile new dimension to the crisis and raised concerns about sustained escalation, underscoring the need for vigilance in protecting critical systems and managing escalation dynamics across both domains.

INTRODUCTION

India and Pakistan have a long history of physical and cyber confrontation, and as both countries are nuclear powers and possess advanced cyber resources, the stakes are high.

The late April 2025 terrorist attack on Indian civilians in Kashmir precipitated a rapid intensification of hostilities. In response, India conducted precision missile strikes across the Line of Control into Pakistan and Pakistan-administered Kashmir, prompting a forceful counter-response in the air and on the ground. This was further paralleled by aggressive cyber actions, and within days of the initial attack, hacktivist groups on both sides – motivated by political, social, or religious ideologies – began launching retaliatory campaigns online.

This report examines the background, key actors, tactics, and observed impacts of the hacktivist escalation during this crisis and draws on open-source intelligence and security analysis to provide a comprehensive, balanced overview of the cyber dimension of the conflict.

BACKGROUND AND TIMELINE OF EVENTS

On April 22, 2025, a militant attack on tourists in Pahalgam (Jammu and Kashmir) killed dozens of civilians. India accused Pakistan-backed elements of sponsoring the attack, and diplomatic relations subsequently deteriorated: border crossings were closed, diplomatic expulsions occurred, and both militaries entered high-alert status, with hacktivist activity accelerating within approximately 48 hours of the Pahalgam incident.

Dozens of pro-Pakistan-aligned hacktivist groups – many with roots in South Asia and Southeast Asia – claimed online operations against Indian targets, and the volume of cyberattacks on Indian networks grew sharply through the last week of April, peaking around April 30. This early wave of attacks involved website defacements, DDoS campaigns, and alleged data breaches, and were often framed as retaliatory gestures for the Kashmir violence.

The physical conflict escalated in May with a coordinated series of Indian missile strikes inside Pakistan and Pakistan-administered Kashmir, with Pakistan apparently retaliating by reporting the destruction of Indian aircraft. Hacktivist groups quickly convened around the hashtag “#OpIndia”, and between May 7 and May 10, the intensity of attacks grew with some threat-monitoring teams reporting that the daily rate of DDoS attacks against Indian sites had soared 100-fold.

A ceasefire on May 10 brought large-scale kinetic exchanges to a temporary halt, but cyber operations continued until May 11, demonstrating a lag between military and hacktivist operations, or a “feedback loop” between battlefield events and online skirmishes.

KEY ACTORS AND GROUPS

A wide array of actors participated in the cyber front, including loosely organized hacktivist collectives, individual patriotic hackers, and possibly state-affiliated operators.

Pro-Pakistan hacktivist groups: Many of these have roots in neighbouring countries, with notable names such as AnonSec and Keymous+, as well as Islamically-oriented groups like the Islamic Hacker Army, and regional collectives, such as Sylhet Gang, RipperSec (based in Bangladesh), Arabian Hosts, Red Wolf Cyber, and Team Insane PK. Some groups carried nationalistic or religious brandings, whereas others used generic names like “Electronic Army Special Forces” or “Nation of Saviors.” An Iranian-affiliated group named “Vulture” publicly announced support for Pakistan, and a well-known threat actor historically associated with Pakistan, APT36 (aka Transparent Tribe), was also active. Analysts suggest it used more sophisticated malware (Crimson RAT) to target Indian infrastructure, although its relation to hacktivism is murky: many of these groups publicly claimed responsibility for attacks on Indian websites, often sharing graphics or statements on social media or Telegram channels, but in practice, these groups ranged from highly skilled to opportunistic.

Pro-India hacktivist groups: In turn, Indian hackers and sympathetic groups launched counterattacks, including Indian Cyber Force, Indian Cyber Defender, Unknown Cyber Cult, Kerala Cyber Xtractors, and others. These groups reported launching DDoS attacks against Pakistani targets and, in some cases, claimed to hack Pakistani government and institutional websites. Their stated goals were defensive or retaliatory, aimed at deterring pro-Pakistani hackers (for example, one group asserted that it breached data on Pakistani financial and tax websites, but such claims often lacked external validation.

Both governments also focused on cyber defense. India temporarily restricted access to its national stock exchange’s website in anticipation of cyberattacks, and Pakistani authorities warned critical infrastructure operators to be vigilant. State-sponsored actors likely monitored the situation, though the bulk of public activity came from non-state groups. In summary, key actors included diverse hacktivist collectives on both sides, backed or encouraged by nationalistic narratives, with tacit engagement from security agencies focusing on defense.

OPERATIONS AND TACTICS

Cyber operations during the conflict were characterized by their visibility and publicity rather than deep technical sophistication. Approximately half of the documented incidents were DDoS attacks aimed at making websites offline, and about a third were defacements—where attackers altered the visible content of a site with propaganda messages or taunts. Smaller numbers of incidents involved alleged data breaches (but these were often of limited scope) and attempted network intrusions.

DDoS Attacks: Hacktivists utilized both volumetric floods (overwhelming traffic attacks) and targeted application-layer floods. In some reported cases, they used reflection/amplification methods (like NTP or DNS amplification) to magnify their traffic. Application-layer attacks mimicked legitimate user behavior to exhaust server resources, with targets including government portals, defense agency sites, public healthcare systems, and municipal services. While many DDoS waves lasted minutes to hours, a few continued for much longer; for instance, monitoring data indicated the official Indian Defense Ministry site endured a sustained DDoS for over 19 hours on May 10. Such prolonged attacks often forced defenders to shut out foreign traffic or temporarily offline critical web services to mitigate the impact.

Website Defacements: Websites (particularly small institutional and local government pages) had their homepages corrupted with political slogans or graphics, typically displaying messages sympathizing with Kashmir, or framing India-Pakistan events as a religious struggle. Many defacements were low-level (exploiting weak content management systems) and more about propaganda than extracting data. They served to broadcast the hacktivists’ messages widely, even if they did not disrupt services for long.

Exploited Vulnerabilities:

• CVE-2024-4577 (PHP CGI Argument Injection): This vulnerability allows attackers to execute arbitrary code on servers running vulnerable versions of PHP in CGI mode. Exploiting this, attackers could gain unauthorized access to web servers, facilitating defacements and further intrusions.
• PHP File Upload Plugin Weaknesses: many websites utilized outdated or misconfigured PHP file upload plugins, lacking proper validation and security checks. Attackers exploited these weaknesses to upload malicious scripts, such as web shells, enabling them to manipulate website content or execute further attacks.

Data Breach Claims: Some groups claimed to have exfiltrated databases or sensitive files from target systems, however, most of these claims could not be independently verified (or purported stolen data appeared to be old, incomplete, or recycled from prior incidents). It is possible these claims were intended more as psychological warfare—to suggest penetration—than actual extensive breaches. For example, one Pakistani hacktivist group claimed to have stolen student records from an Indian university, but there was no confirmation beyond the hackers’ announcement.

Other Tactics: Beyond overt attacks, there were attempts at social engineering and credential phishing, though these are harder to track publicly. A few groups also experimented with ransomware or deploying malware like stealer Trojans, but again, none of these more advanced operations achieved headline successes during the crisis period. In summary, hacktivist operations favored high-visibility disruptions (DDoS, defacement) that could be executed quickly, while more covert attacks remained limited or ineffective.

ANALYSIS AND EVIDENCE

Phishing:
As part of the broader cyber escalation following Operation Sindoor, threat actors launched a sophisticated credential phishing campaign targeting Indian government personnel. The below screenshot reveals a forged document impersonating the National Informatics Centre (NIC), falsely claiming a migration of services to a cloud infrastructure labeled “mgovcloud.” The message promotes features like antivirus scanning and secure storage to instill trust while embedding a malicious link designed to harvest NIC login credentials. By exploiting trust in official branding and urgent-sounding language, such social engineering tactics aim to compromise access to sensitive data, including operational updates on high-impact national security events, such as the Pahalgam terror attack. These attacks signify the increased weaponization of misinformation and spoofing in modern cyber warfare.

DDoS Attacks
These campaigns began with highly sophisticated phishing lures, including documents impersonating Indian authorities (such as the NIC) and government portals (e.g. “gov.in”) urging personnel to migrate to fake platforms via malicious links. These social engineering techniques exploited institutional trust to gain unauthorized access to sensitive defense and administrative systems.

Simultaneously, multiple Telegram-based threat groups (such as Keymous+, Keymous+, AnonSec, Nation of Saviors, and Sylhet Gang) issued public claims of cyberattacks against critical organizations, including:

• The Ministry of Defense
• Indian Army, Navy, and Air Force domains
• CERT-In, NCIIPC, C-DAC, IPS portals
• HAL, BDL, and Mazagon Dock Shipbuilders
• Indian embassies and nuclear infrastructure

The attackers provided “proofs” through Check-Host links showing outages, supported by screenshots. These campaigns often included Arabic messaging and heavily used hashtags like #OpIndia to amplify their psychological impact.

Data Breach
Pro-Indian cyber group CyberForceX executed a targeted breach of Pakistani educational and civic databases, including an attack on an educational institution that exposed sensitive information. This breach not only highlights a tit-for-tat cyber escalation but also underscores growing cyberwarfare sophistication and the exploitation of weakly protected databases in geopolitical cyber conflicts.

One breach, publicly flaunted by Keymous+, took just 1.3 minutes, suggesting automated tools or previously exploited vulnerabilities were used. Screenshots shared by these groups reveal JSON and Excel-formatted data dumps, and terminal outputs confirming once again access to backend databases. These breaches pose serious risks of identity theft, phishing, and misuse of personal data, indicating a well-coordinated effort to undermine India’s public digital infrastructure.

Website Defacement
The Pakistani group “lxrdk1773n” targeted an Indian educational institution’s website, accusing Indian systems of criminality. Their message employs psychological warfare tactics, claiming to reveal “cracks” in Indian cybersecurity while undermining public trust in government institutions. In retaliation, the Indian Cyber Mafia responded by defacing a Pakistani government website, escalating the conflict with more aggressive threats including references to military action and promises of widespread digital destruction across Pakistan. This exchange illustrates the characteristic pattern identified in threat intelligence reports where both sides engage in website defacements as low-cost, high-visibility attacks designed more for psychological impact and propaganda than technical sophistication. The defacements serve dual purposes: demonstrating the technical capability to penetrate adversary systems while delivering nationalist messaging that amplifies existing political tensions between the two nations. These incidents reflect the broader hacktivist surge where groups leverage cyber operations as extensions of conventional geopolitical rivalry, using digital platforms to wage information warfare and assert dominance in cyberspace.

Indian Cyber Mafia:

lxrdk1773n:

Malware
The Pakistan-linked threat actors SideCopy and APT36 (also known as Transparent Tribe) are actively conducting sophisticated cyber espionage campaigns utilizing a diverse arsenal of attack vectors. These groups are leveraging weaponized PDF documents containing malicious payloads, Microsoft Office files embedded with macro-based malware deploy RATs, Executable and Linkable Format (ELF) binaries targeting Linux systems, and advanced Mythic Command and Control (C2) frameworks for persistent network access and data exfiltration operations.

This VBA macro script appears to be part of a malware payload delivery mechanism that executes when triggered within an Office document. It begins by setting up a file system and shell objects to handle file operations and execute commands. The macro dynamically generates a directory path in the user’s Downloads folder based on the current time, which helps avoid detection and overwriting issues. It creates a folder and names a new file using a randomized string with replaced extensions to disguise its true nature. The script copies multiple files, such as endoscks, word/media/image1.png, word/media/image2.png, and others, into the new directory using the CopyHere method, effectively staging the payload. Later, it uses the Shell function to silently execute one of the PNG files, which may be a disguised executable. Finally, the script opens a Word document from the copied files programmatically using Documents.Open, likely to run embedded malicious content or further macros. Throughout, the code uses string manipulation and stealth techniques to obfuscate its true purpose and evade antivirus detection.

CONCLUSION

The 2025 India–Pakistan crisis illustrates the increasingly complex nature of modern conflicts. In parallel with missiles and diplomatic maneuvers, a sprawling hacktivist escalation unfolded online, with dozens of ideologically-driven groups rapidly mobilized to “fight” in cyberspace – flooding websites, posting propaganda on breached pages, and broadcasting claims of digital victories. Even if most technical breakthroughs were meager, the sheer scale of the campaign broke new ground, with critical infrastructure – from government portals to stock exchanges – coming under attack.

This hybrid escalation underscores several key points. First, open-source evidence shows that non-state actors can quickly co-opt a national crisis into a global cyber movement, crossing borders and blurring lines between activism and warfare. Second, while hacktivist methods are often unsophisticated, their capacity to amplify tensions and sow uncertainty should not be underestimated, as even “fake” breaches can shake confidence and force costly precautionary measures. Third, the crisis demonstrated how traditional deterrence logic becomes more complicated when such actors are involved: neither nation can fully control or predict all the online entities claiming to act on its behalf.

Going forward, both India and Pakistan face the challenge of securing their networks against a wider array of threats, including ideological activists whose calculus is not tied to official state policies. The recent events serve as a reminder that in today’s internet-connected world, low-cost cyber operations will continue to intersect with conventional diplomacy and warfare. For policy-makers and defenders alike, the lesson is clear: robust cyber defenses, rapid information-sharing, and de-escalation channels are as essential as battlefield readiness. Only by acknowledging the role of these hacktivist fronts can future escalation be managed more effectively, preventing local conflicts from spiraling unpredictably in the digital realm.

INDICATORS OF COMPROMISE (IOCs)