Cyber Incident Victim: Pakistan Bar Council
Timeline
Summary
Indian hackers operating under the name IBH defaced multiple Pakistani websites, including the Pakistan Bar Council and several government and private entities, as retaliation for a terrorist attack on an Indian military base that resulted in casualties including Lt. Col. Niranjan Kumar. The defacements displayed messages honoring Kumar and his daughter while condemning the attackers linked to the Jaish-e-Mohammed militant group. This incident mirrored prior cyber operations by Indian groups targeting Pakistani digital assets following major attacks, demonstrating ongoing hacktivist responses to geopolitical tensions between the two nations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In January 2016, Indian hacking group IBH (Indian Black Hats) defaced seven Pakistani websites following the Pathankot terrorist attack on an Indian Air Force station. The attack, which occurred earlier that month, involved assailants wearing Indian Army uniforms killing seven security personnel and one civilian. Among the victims was NSG Commando Lt. Col. Niranjan Kumar, who died while attempting to defuse a grenade during the incident. Indian authorities subsequently identified links between the attackers—associated with Jaish-e-Mohammed—and individuals in Pakistan. The hackers explicitly stated their actions were retaliation for Kumar's death and a tribute to his two-year-old daughter Vismaya, whose photograph they displayed on compromised sites.
The defacements targeted mid-tier Pakistani organizations rather than critical government infrastructure. Affected entities included the Pakistan Bar Council, Centre for Pakistan and Gulf Studies, SOLP Institute of Modern Languages, Fotile (a kitchen appliance retailer), M. Aslam Sons (a leather goods manufacturer), a government horse remount institution, and a government-run canteen and store. IBH replaced site content with a message saluting Kumar and other slain soldiers, stating: *"This Attack is dedicated for VismayA... A Small Tribute to those Brave Soldiers who Laid their Precious Life for our Country."* The group framed the operation as parallel to previous Indian hacktivist campaigns, referencing a 2008 incident where 125 Pakistani sites were defaced after Lashkar-e-Taiba's Mumbai attacks. No technical details of intrusion methods, defensive responses, or long-term consequences for the compromised organizations were disclosed in available reporting.