Digital Kill Chain: The APT-Style Espionage Targeting Danish Farrukh Thanvi

The investigation into Case HRPM-BCG20260 has uncovered a sophisticated digital espionage 'kill chain' directed at Danish Farrukh Thanvi. This was not a simple hack, but an APT-style (Advanced Persistent Threat) operation involving malware deployment, disk imaging, and identity hijacking (Zubair as Sharjeel). The objective was the total exfiltration of company data and the subsequent destruction of forensic evidence to hide a PKR 17M fraud.

Key Findings

Malware Deployment: Documentation reveals the use of Screen Memory malware to monitor communications in real-time.

Disk Imaging: The use of Macrium Reflect allowed perpetrators to create bit-for-bit copies of local machines, enabling data theft without immediate detection.

Data Exfiltration: Google Takeout was weaponized to export entire communication histories before accounts were changed or locked.

Sanitization: On March 27, 2026, the syndicate brought in an operative to scrub logs, a classic 'cleaning' phase of a cyber-physical takeover.

Evidence & Data

The digital forensics report highlights that the password for the primary finance account was changed on March 31, 2026, during the peak of the investigation. This occurred shortly after the 67 unauthorized payments were flagged. The digital identity of 'Zubair' was systematically used to impersonate 'Sharjeel,' providing the necessary 'authorization' for these technical maneuvers.

Legal Framework

PECA 2016 Section 3 & 4: Unauthorized access to information systems and data copying.

PECA 2016 Section 10: Cyber terrorism (if the intent was to cause fear or destabilize a critical institution like a background check firm).

ICCPR Article 17: Violation of the right to privacy and digital correspondence.

UDHR Article 12: No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence.

Recommendations

1. Immediate forensic imaging of all servers by a third-party international firm to bypass local 'log scrubbing.'
2. Criminal referral for the 'night shift operative' and the management who authorized the termination of Horizon Technologies.
3. Tracking the destination of the Google Takeout archives to identify where the firm's intellectual property currently resides.

Read the full case file on HRPM for Case HRPM-BCG20260.