Romantic

Profile narrative

Romantic and Intruder are the aliases used by a pair of Pakistani hackers who have publicly claimed affiliation with the Pakistan Army and have been linked to the broader hacking collective known as Team Pak Cyber Attackers. Their activity came to light in mid‑2016 when they carried out a series of website defacements targeting Indian government assets. The actors identify themselves through the aliases in the defacement messages they leave on compromised sites.

Their typical targets have been Indian diplomatic missions abroad and Indian state police websites, reflecting a focus on government and symbolic infrastructure rather than commercial or financial entities. The strategic objective evident from their actions is disruption and propaganda, as they replace legitimate content with pro‑Pakistan slogans, national flags, and taunts directed at Indian authorities. No evidence in the provided material points to financial gain or espionage as a primary motive for these specific actors.

The observed tactics, techniques, and procedures consist mainly of web defacement achieved by exploiting vulnerabilities in the target sites to alter publicly visible pages. The actors leave messages that assert their connection to the Pakistan Army, display the Pakistani flag, and include political slogans such as “Pakistan Zindabad.” No malware families, specific exploit kits, or alternative initial access vectors are described in the sources for Romantic and Intruder.

A notable campaign occurred on June 11 2016, when Romantic and Intruder defaced the websites of seven Indian embassies located in Turkey, Greece, Mexico, Brazil, Romania, Tajikistan, and South Africa, while a separate hacker from Team Pak Cyber Attackers, Faisal 1337, defaced the Karnataka State Police portal. All affected sites were restored after investigations, and the incident was cited as part of the ongoing cyber hostilities between Indian and Pakistani hacker groups rooted in broader geopolitical tensions. This operation remains the most clearly documented activity associated with the Romantic and Intruder aliases.

Incidents

Attributed incidents are available to members.