Cyber Threat Actor: Romantic

Romantic is a threat actor operating under the alias Romantic, also known as Intruder, and is based in Pakistan. The actor publicly claims affiliation with the Pakistan Army and operates alongside the group Team Pak Cyber Attackers. These affiliations are presented in the actor’s own statements during attacks and are reflected in the propaganda messages left on compromised sites. The actor’s activity is limited to the information available from reported incidents, with no additional background details provided in the source material.

The actor’s targeting focuses on Indian government entities, specifically diplomatic missions such as embassies and consulates, as well as state police websites. The observed actions involve defacing these online properties to display pro‑Pakistan slogans, national flags, and messages that taunt Indian authorities. The strategic objective evident from the incidents is disruption through website alteration coupled with propaganda promotion of Pakistan and its military. No financial gain or espionage intent is mentioned in the supplied reports.

The tactics, techniques, and procedures noted consist primarily of website defacement, where the actor replaces existing content with political messages and symbols. No specific malware families, exploit kits, or initial access vectors are described in the sources; the emphasis is on the defacement act itself and the use of straightforward tools to alter web pages. The actor’s tooling style appears to be limited to web‑based alteration methods rather than sophisticated intrusion frameworks.

A representative operation occurred on June 11 2016, when Romantic, together with Intruder and a member of Team Pak Cyber Attackers identified as Faisal 1337, defaced seven Indian embassy websites across multiple countries and a Karnataka State Police portal. The attacks featured the placement of pro‑Pakistan Army messages, flags, and slogans such as “Pakistan Zindabad,” followed by the restoration of the sites after investigations. This campaign illustrates the actor’s pattern of politically motivated disruption targeting Indian diplomatic and law‑enforcement online assets.