Digital Espionage: The Insider Threat Kill Chain Targeting Danish Farrukh Thanvi

This report documents a years-long digital espionage campaign against Danish Iqbal Thanvi (Group CEO of BCG) documented under case HRPM-DTH20160. Leveraging the chaos of state-led harassment, a syndicate of internal employees utilized advanced persistent threat (APT) techniques, including malware, disk imaging, and identity hijacking, to compromise the legal and personal security of the victim.

Key Findings

The Surveillance Toolkit

Evidence identified through hidden_records_hunt protocols reveals the use of forensic-grade tools for non-authorized data collection:

Macrium Reflect: Used for unauthorized full disk imaging of corporate and personal workstations to secure 'offline' copies of sensitive data.

Google Takeout Exfiltration: Systematic exploitation of account export features to bypass standard data loss prevention (DLP) protocols.

Identity Hijacking: Documented instances of 'Zubair' assuming the digital identity of 'Sharjeel' to authorize transfers and access restricted MIS layers.

Execution & Timing

On 2026-03-20, intercepted communications revealed that CS email accounts were being reconfigured on Exchange to create 'backups' that were surreptitiously shared with unauthorized parties (Jahanzeb). This occurred simultaneously with state actor interventions by the FIA, suggesting a coordinated effort to provide 'evidence' that had been tampered with or fabricated.

Legal Framework

The unauthorized access and exfiltration of data fall under the Prevention of Electronic Crimes Act (PECA) 2016, specifically sections regarding unauthorized access to information systems and data. Furthermore, the International Covenant on Civil and Political Rights (ICCPR) Article 17 protects individuals against arbitrary or unlawful interference with their privacy and correspondence—a right systematically violated here.

Recommendations

Digital forensics experts must conduct a full 'Chain of Custody' audit. The current status of 'Broken Chain of Custody' in the HRPM data indicates that any evidence collected by regulators like NADRA or the FIA may be legally inadmissible due to these internal compromises.

Read the full case file on HRPM: Case HRPM-DTH20160.