Cyber Threat Actor: ZCompany Hacking Crew

ZCompany Hacking Crew, also known as ZHC, is a hacktivist group that has been publicly identified with aliases reflecting its name and operates from a base that has been reported as Pakistan. The actor’s public statements and defacement messages consistently frame their actions as part of a broader campaign supporting Kashmiri independence and criticizing Indian security policies in the region. Their activity is limited to the information available in open sources, which shows a pattern of targeting Indian government and paramilitary web properties rather than pursuing financial gain or espionage objectives.

The group’s typical targets include national portals, state government sites, and paramilitary organization websites, all located within India. In the incidents described, ZHC defaced the Bharatiya Janta Party’s Rajkot City website and the National Portal of India, posting messages that advocated for Kashmir’s freedom, condemned alleged civilian casualties by Indian forces, and demanded the withdrawal of security troops from Jammu and Kashmir. These actions indicate a strategic objective centered on political disruption and propaganda dissemination rather than data theft or monetary profit. The observed tactics involve gaining unauthorized access to web servers to upload defacement pages; no specific malware families, exploit kits, or initial access vectors are detailed in the provided sources, and the group’s tooling appears limited to web‑based defacement techniques.

Notable operations attributed to ZHC include the February 2014 breach of india.gov.in, where they left a signed message on both desktop and mobile versions of the portal, and the October 2014 defacement of the BJP Rajkot City site in support of an independent Kashmir. The group has also claimed responsibility for attacks on the Rajasthan state website and the Assam Rifles paramilitary site, and it announced an attempted intrusion against the Pakistani hacker collective Team Madleets, which was publicly denied by the latter. No public evidence links ZHC to a state sponsor or a larger criminal consortium, and the actor’s size, sophistication, or revenue remains unspecified in the available material. The profile therefore reflects only the confirmed facts: a Pakistan‑based hacktivist collective using website defacement to promote a Kashmiri independence narrative against Indian governmental targets.