Cyber Threat Actor: IBH

The threat actor known as IBH, also referred to as Indian Black Hats, operates from India and has been identified in open sources as a hacking crew that conducts website defacements. The group uses the acronym IBH to sign its actions and has publicly claimed responsibility for attacks against Pakistani online assets. Their activities are described in reporting as retaliatory and commemorative in nature, motivated by specific cross‑border incidents rather than financial gain.

IBH’s targeting has focused on Pakistani government and private sector websites, including a government horse remount institution, a government caring store and canteen, the Pakistan Bar Council, the Centre for Pakistan and Gulf Studies, the SOLP Institute of Modern Languages, the private kitchen appliance retailer FOTILE, and the leather products manufacturer M. Aslam Sons. The actors have avoided major government portals, instead selecting smaller governmental bodies and commercial enterprises. Their strategic objectives, as evidenced by the messages left on compromised sites, are to pay tribute to deceased Indian security personnel and to condemn the militant groups blamed for the attacks that provoked the defacements, indicating a symbolic or demonstrative aim rather than espionage or profit‑driven motives.

The only technique explicitly referenced in the available material is website defacement, whereby the actors replace site content with a prepared tribute message and an image of the victim’s daughter. No malware families, specific initial access vectors, or particular tooling styles are described in the sources, so no further technical details can be stated. Attribution to a state sponsor or affiliation with a criminal consortium is not established in the reporting; the group is presented as an independent hacking crew. A representative campaign is the January 2016 operation in which IBH defaced multiple Pakistani websites as homage to NSG Commando Lt. Col. Niranjan Kumar following the Pathankot attack, an action that echoes an earlier large‑scale defacement effort after the 2008 Mumbai attacks in which the group reportedly altered 125 sites. These incidents constitute the publicly reported operations associated with IBH.