Unverified claim — July 11, 2026: Open-source accounts reported that a Pakistani hacking syndicate branding itself "Zulfiqar APT Group" advertised a massive dump of Indian strategic and military-sensitive data on the dark web. The alleged haul spans DRDO project material, more than 5,000 military personnel files, Ministry of Defence logs, and data tied to HAL and BHEL systems—per The STRATCOM Bureau and regional social amplification. India's Ministry of Defence had not confirmed any matching breach at indexing time.
What the actors claim
Reporting summarized on July 11 describes a dark-web release—not a company press release—alleging:
- Sensitive DRDO project and controlled-information files
- Critical data on 5,000+ military personnel
- Ministry of Defence operational logs
- System data associated with Hindustan Aeronautics Limited (HAL) and Bharat Heavy Electricals Limited (BHEL)
Defence-focused OSINT accounts framed the dump as retaliation-themed marketing in a tense South Asian cyber narrative. That is context, not proof.
What is not confirmed
No July 2026 statement from India's Ministry of Defence, DRDO, HAL, or BHEL validated the Zulfiqar listing in public channels reviewed for this catalog entry. Without samples authenticated by independent researchers or government acknowledgment, treat terabyte-scale ad copy and personnel counts as unverified actor marketing.
India has seen prior separate defence-sector leak claims—March 2025's Babuk Locker 2.0 DRDO narrative involved a different group, a partial 753 MB sample, and government sources telling press the "20 TB" figure was exaggerated (ThePrint). Do not merge unrelated incidents because the victim sector rhymes.
Why the claim still matters
Even unverified defence dumps move markets and militaries. A credible-looking archive—real tender PDFs mixed with junk—can fuel disinformation, spear-phishing against contractors, and procurement fraud. DRDO, HAL, and BHEL sit in global supply chains; their vendors are softer targets than hardened ministry networks.
For India, the recurring pattern is leak-site prestige hacking: publish a slice, let OSINT accounts amplify, wait for denial or silence, then sell access to the rest.
Who should watch
Defence contractors, cleared personnel, and vendors with DRDO or HAL/BHEL portal accounts should:
- Ignore download links from Telegram or paste sites claiming "full Zulfiqar dump"—archives often carry malware.
- Report anomalous logins on ministry and PSU portals immediately.
- Treat defence-themed recruitment or tender emails as suspicious until verified out-of-band.
Canonical record
India MoD / Zulfiqar APT claim on BreachHistory — indexed as unverified.
Sources: The STRATCOM Bureau (X), ThePrint (prior Babuk/DRDO context).