Team Pak Cyber Attackers

Profile narrative

The threat actor tracked under the aliases Team Pak Cyber Experts, Team Pak Cyber Attackers, Pak Cyber Attackers and Pakistan Cyber Force is known to operate from Pakistani territory. In addition to its primary names, the group has been observed using the individual handles Faisal 1337, Romantic and Intruder across different intrusion reports. Open‑source accounts tie the actor to a prolonged series of website defacements that focus on Indian governmental and diplomatic online properties. Activity attributed to the collective dates back to at least 2015 and has persisted through 2025, showing a multi‑year operational timeline. Analysts characterize the actor’s motivation as politically driven disruption rather than financially oriented crime, based on the nature of the messages left after compromises.

The actor’s victim list includes central and state government portals, police department websites, revenue service platforms and educational department domains mainly situated within India. Beyond Indian targets, the group has successfully altered the Google Bangladesh domain and the official passport office website of Kolkata, demonstrating a willingness to strike foreign‑hosted assets. Each compromise typically replaces the original page with pro‑Pakistan slogans, the Pakistani flag and taunting statements that question the target’s security posture. In several incidents the perpetrators have explicitly claimed affiliation with the Pakistan Army, embedding declarations of readiness for confrontation within the defacement text. The observable purpose of these actions appears to be the dissemination of propaganda, the disruption of normal service and the signalling of capability, with no indication of data theft or monetary extortion.

The group's principal method involves exploiting identified vulnerabilities in web applications to gain unauthorized access and replace content, a technique commonly described as website defacement. Public disclosures do not link the actor to any particular malware family, ransomware variant or advanced intrusion framework, suggesting a reliance on relatively simple web‑based exploits. Illustrative operations referenced in reporting comprise the 2025 alteration of Rajasthan’s Education Department portal, the 2019 Chhattisgarh BJP site defacement and the 2016 coordinated defacement of seven Indian embassy websites together with a Karnataka State Police site. Additional notable events include the 2016 hijack of the Google Bangladesh domain and the 2015 compromise of the Kolkata passport office site, both accompanied by the group’s signature messaging. Across all reported incidents the actor leaves a consistent set of phrases and symbols, restores the affected sites after the defacement and avoids maintaining prolonged foothold, indicating a focus on visible impact rather than persistent access.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 10 sources.