Inside the Faisalabad Cybercrime Ring
A Symptom of Pakistan’s Security State Rot
In the early hours of July 8, 2025, operatives from Pakistan’s National Cyber Crime Investigation Agency (NCCIA), acting on intelligence support, launched a raid on a factory compound located in Chak 54-RB, Sirohli, within the jurisdiction of Balochni Police Station, on the outskirts of Faisalabad in Toba Tek Singh District. Far from a typical residence, the site functioned as a sophisticated command center for transnational cyber fraud, a clandestine call center outfitted with high-end computing systems, dedicated servers, and telecom equipment. The operation served as the nerve centre for a web of digital crimes, including Ponzi schemes, financial phishing, impersonation of Pakistan’s Benazir Income Support Programme (BISP), and illicit banking access.
The raid led to the detention of 149 individuals, comprising 78 Pakistani nationals and 71 foreign operatives, including 48 Chinese citizens and smaller groups from Nigeria, the Philippines, Sri Lanka, Bangladesh, Myanmar, and Zimbabwe. Among those apprehended were at least 18 women, several of whom concealed their faces from the media as they were transported to court the following day. The discovery of such a highly international and technologically sophisticated syndicate in rural Punjab exposed not only the scale of cybercrime operating within Pakistan’s borders but also the systemic oversight, or complicity, that had allowed it to flourish in plain sight.
The syndicate’s modus operandi was insidious and multifaceted. Operatives impersonated officials from government welfare schemes like the Benazir Income Support Programme (BISP), lured victims into fictitious investment opportunities via Ponzi schemes, and orchestrated banking intrusions to divert funds across borders. One documented victim in Pakistan reported losses exceeding 3.1 million rupees, highlighting the operation’s tangible human cost. Authorities seized an array of digital evidence: computers, mobile devices, and documents chronicling frauds spanning Pakistan, China, and potentially further afield.
Yet, this ostensibly triumphant enforcement action belies a labyrinth of institutional failings and entrenched protections. The property raided belonged to Malik Tahseen Awan, a former chairman of the Faisalabad Electric Supply Company (FESCO) Board of Directors and a figure with longstanding affiliations to the ruling Pakistan Muslim League-Nawaz (PML-N). Awan’s political rise was publicly endorsed by Rana Ahmed Shahryar Khan, the PML-N Youth Wing’s Central Senior Vice President, who in 2022 celebrated Awan’s appointment to FESCO as a step toward “infrastructure revitalisation.” His connections within the party reportedly extend to senior figures like Rana Sanaullah Khan, whose regional and ministerial clout would have afforded Awan significant bureaucratic insulation. Locally, Awan enjoyed deep patronage networks in Faisalabad’s PML-N establishment, where his influence over civic and industrial governance was well documented. Despite being the alleged kingpin of the cybercrime syndicate, Awan evaded capture during the July 8 raid, with credible reports indicating that he fled hours before the NCCIA’s operation, suggesting forewarning from within the state. While efforts are now underway to add his name to the Provisional National Identification List (PNIL), his absence from the initial charge sheets filed under PECA and the Pakistan Penal Code underscores a troubling pattern of selective enforcement. The contrast is stark: 149 individuals, many of them foreign nationals, were swiftly detained, yet the politically connected central figure remains at large, shielded by a state apparatus that punishes expendables and protects its own.
This investigation delves into the connective tissue binding this cybercrime syndicate to broader patterns of impunity, geopolitical accommodations, and a surveillance apparatus that appears omnipotent yet conveniently myopic. In a nation where digital oversight is wielded as a tool of control, the Faisalabad operation’s longevity raises profound questions: Was this an aberration, or a protected enterprise emblematic of a state that safeguards elites and allies while ordinary citizens bear the brunt of cyber threats?
The Faisalabad bust emerged from the NCCIA’s broader “Operation Grey,” initiated in June 2025 to dismantle digital fraud networks with Interpol collaboration. Established in 2024 under Section 51 of the Prevention of Electronic Crimes Act (PECA) 2016, the NCCIA represented Islamabad’s response to escalating cyber threats, supplanting the Federal Investigation Agency’s (FIA) National Response Centre for Cyber Crime (NR3C). Yet, the agency’s remit, bolstered by a dedicated helpline and promises of enhanced forensics, has yielded mixed results. By July 9, 2025, 87 suspects were remanded to NCCIA custody for five days, with 62 others held pending further hearings.
The operation’s scale demanded resources: sustained high-bandwidth connectivity for international communications, secure data servers, and logistical support for a diverse workforce. In a country where the Pakistan Telecommunication Authority (PTA) monitors traffic anomalies and mandates real-time data sharing, such activities should have triggered alarms. Moreover, the influx of foreign nationals, many on ostensibly work visas, bypassed routine labour inspections and immigration scrutiny, despite Faisalabad’s industrial zoning regulations.
Connecting these dots reveals a chronology of ignored signals. Telecom sector insiders have long flagged unusual data spikes in regional hubs, yet no pre-emptive action materialised. This inertia contrasts sharply with the state’s alacrity in deploying PECA against perceived threats: in December 2024 alone, 150 journalists faced charges for alleged disinformation.
Pakistan’s security architecture, anchored by the Inter-Services Intelligence (ISI), operates one of the region’s most pervasive surveillance regimes. In July 2024, the federal government explicitly empowered the ISI to intercept telecommunications via the Lawful Intercept Management System (LIMS), a nationwide apparatus capable of capturing calls, messages, and metadata without judicial oversight. Historically, ISI monitoring has ensnared politicians, judges, and activists, evidenced by 2024 revelations of wiretaps on judicial figures. Yet, in Faisalabad, a hub of anomalous digital activity involving foreign actors, no such vigilance surfaced. This selective blindness aligns with a pattern: while social media critiques of the establishment prompt swift arrests, economically disruptive syndicates flourish unchecked.
The preponderance of Chinese nationals, 48 in total, infuses the case with geopolitical undertones. Pakistan’s strategic entanglement with China, epitomised by the China-Pakistan Economic Corridor (CPEC), has fostered an environment of deference. Since CPEC’s inception, approximately 30,000 Chinese workers have been deployed across Pakistan, often in fortified enclaves amid escalating militant threats.
In 2024, a spate of attacks on Chinese personnel, culminating in demands for Rs 90 billion in protective allocations, prompted Beijing to advocate for joint security ventures and even its own personnel in Pakistani firms. By March 2025, a bilateral Memorandum of Understanding on cybersecurity cooperation was ratified, emphasising threat prevention and information sharing. Yet, in the Faisalabad aftermath, the Chinese Embassy has issued no formal rebuke, and repatriation discussions remain opaque.
Pakistan’s abstention from the Budapest Convention on Cybercrime, justified on sovereignty grounds, further hampers international probes. This stance, coupled with expedited visas for Chinese applicants, suggests a calculus where economic alliances eclipse accountability, potentially allowing cyber syndicates to exploit such leniency.
Malik Tahseen Awan’s evasion exemplifies a entrenched culture of selective prosecution. Appointed FESCO chairman in 2022 with PML-N endorsements, Awan oversaw grid upgrades and expansions, positioning him as a key infrastructural player. His PML-N ties, evident in party leaders’ public congratulations, afford him a shield akin to that enjoyed by other elites, from property magnates implicated in money laundering to politicians ensnared in offshore scandals.
Off-record accounts from telecom and visa officials describe a system of “prioritised ignorance”: anomaly reports shelved, fast-tracked clearances for CPEC-linked personnel, and a climate of fear deterring disclosures. This complicity extends to cyberwarfare arenas, where Pakistan accuses India of digital incursions yet fails to fortify its internal defences.
The Faisalabad syndicate’s operations inflicted billions in losses, undermining economic stability in a nation grappling with fiscal woes. Amid Indo-Pak cyber tensions, marked by infrastructure hacks—the irony is that a state demanding digital sovereignty cannot police its own. How many analogous networks persist, shielded by political and geopolitical veils?
This raid illuminates a systemic malaise: a security state that deploys surveillance against the vulnerable while granting impunity to the connected. Rooted in elite protections, geopolitical expediency, and institutional inertia.Absent genuine accountability, Faisalabad will prove merely the tip of an uncharted iceberg.