On March 17, 2023, a hacker group calling itself the Indian Cyber Force got into a police server in Cox’s Bazar, Bangladesh, and walked out with the personal data of about 270,000 citizens. Eleven days later, on March 28, it hit the Khulna Metropolitan Police as well.
The group is based in India and carries out politically motivated attacks on countries whose relations with New Delhi are strained. Canada, Pakistan, China, Palestine, Qatar, the Maldives and Bangladesh have all been on its list. Pakistan has taken the most hits. Observers have described the group as pro-India and pro-Israel, and some of its attacks have been linked to Hindu nationalism and anti-Muslim sentiment. Its own Twitter profile says “Non-Governmental”. Louis Hur, chief executive of the Singapore-based firm StealthMole, argued otherwise in a social media post: by StealthMole’s data, he said, about 23 percent of the group’s members have ties to Indian government-linked bodies, and he suspected state backing.
Canada, Qatar and the Maldives
The group’s biggest foreign campaign began in September 2023, after Prime Minister Justin Trudeau accused India of involvement in the killing of Khalistani leader Hardeep Singh Nijjar. The group named its response “#OpCanada”. It knocked the websites of the Canadian Armed Forces and the Canadian military offline for two hours with DDoS attacks, and went after the House of Commons and Elections Canada the same way. Websites of restaurants and medical clinics were defaced with a Matrix-style digital rain and music. The Ottawa Hospital site suffered a temporary outage. Canada’s Communications Security Establishment listed India as a “cyber threat” in October 2024.
Qatar was next. In November 2023, after Qatar sentenced eight former Indian Navy officers to death in an espionage case, the group reportedly exposed account details, broke into IP cameras and web servers, and took down a national e-commerce portal for two hours. In January 2024, during a diplomatic row between India and the Maldives, it defaced the website of the Maldivian Ministry of Homeland Security and Technology with a message about the country’s alleged “ungratefulness”.
Palestine, Indonesia and Bangladesh again
After the October 7 attacks, the group went after Hamas, the Palestinian National Bank and the Palestinian Telecommunication Company. It also reportedly got into more than 200 networking devices belonging to schools and hospitals in Palestine. Wired quoted Equinix security staffer Will Thomas saying the group had claimed to DDoS hamas.ps and webmail.gov.ps.
During the G20 Summit hosted by India in 2023, the group reportedly compromised 100 websites. It also took down the Indonesian Embassy’s site for around 35 minutes. In August 2024 it turned back to Bangladesh and posted videos it said showed access to a network monitoring dashboard at Grameenphone and other internet providers. On March 18, 2025, it defaced the website of Bangladesh’s Savar Municipality.
The Pakistan campaign
In June 2024 the group claimed to have hacked more than 150 IP cameras, including those of the National Bank of Pakistan. After the Pahalgam attack in April 2025, it said it had breached Habib Bank Limited and taken HR data: employee records, bank account details, education histories and salaries. It posted a 6.6 MB sample file on Telegram as proof. It also claimed breaches at the University of Balochistan and Sindh Police.
On May 6 it said it had compromised more than 1,000 IP cameras across Pakistan. It also leaked a 38.2 MB archive with records of over 150,000 students from the Islamia University of Bahawalpur. News9 examined the data and found most of it authentic, though some records dated from 2021 to 2024. Three days later, the group leaked 150 gigabytes it said came from the Federal Board of Revenue’s IRIS portal, with CNICs, phone numbers, addresses and tax records.
Webz.io named it among the five most active hacktivist groups of 2024. Zone-H holds 43 records of its website defacements, Zone-Xsec 177. By May 2025 it had more than 30,000 followers on Twitter.
