Intruder

Profile narrative

Intruder, also known by the alias Romantic, is a threat actor whose location is identified as India. The actor has publicly claimed association with the Pakistan Army and has been linked to the hacking collective Team Pak Cyber Attackers, notably through the individual Faisal 1337. These affiliations are derived from statements left during attacks and from reporting that connects the aliases to Pakistani military‑aligned groups.

The actor’s observed targeting focuses on Indian government assets, specifically diplomatic missions abroad and domestic law‑enforcement websites. Intruder’s activities have involved defacing the online presences of Indian embassies in countries such as Turkey, Greece, Mexico, Brazil, Romania, Tajikistan and South Africa, as well as the Karnataka State Police portal within India. The strategic objective demonstrated in these incidents is disruption through website alteration, coupled with the dissemination of pro‑Pakistan slogans, flags and taunts directed at Indian authorities to assert a narrative of Pakistani cyber capability. The tactics employed are limited to web‑based defacement, where the actor replaces legitimate content with messages that declare allegiance to the Pakistan Army and includes national symbols; no malware families, initial access vectors or specialized tooling are described in the available sources.

A representative operation occurred on June 11 2016, when Intruder, together with Romantic and a Team Pak Cyber Attackers member, defaced seven Indian embassy websites and a state police site in a coordinated campaign. The defacements featured identical pro‑Pakistan messaging, claimed Pakistan Army backing, and were subsequently restored by the affected organizations following investigation. This episode exemplifies the actor’s pattern of targeting Indian governmental online properties to convey political statements and to signal alleged military affiliation.

Incidents

Attributed incidents are available to members.