Google Workspace Drive audit reconstruction: documents touched while externally exposed, actor IPs, geographies, and outbound transmissions.
100% of external-share activity originates from PK-SD (Sindh, Pakistan), dominated by single residential IPs — consistent with named insiders operating from local workstations, not the published OVH / on-prem corporate egress.
Workspace admin attempted to revoke licenses for the following actors; auto-assigned licenses could not be removed, leaving Drive/Mail access intact during incident response.
| Name | Role | Type | |
|---|---|---|---|
| Danish Farrukh Alvi Thanvi | Owner / CEO | Person | danish@x24.io |
| Muhammad Imran Haroon | Finance Head / CEO (Unauthorized) | Person | finance@backcheckgroup.com |
| Vikash Harjeewan | IT Head / Actor | Person | vikash@backcheckgroup.com |
| Muhammad Yousuf Khan | HR & Admin Manager | Person | yousuf@backcheckgroup.com |
| Muhammad Zubair | Operations Manager | Person | zubair@backcheckgroup.com |
| Dilawar Khan | Finance Officer | Person | dilawar@backcheckgroup.com |
| Background Check (Pvt) Ltd (BCG) | Target Organization | Organization | info@backcheckgroup.com |
| Horizon Technologies (Horizontech) | External IT Vendor | Organization | ali@horizontech.biz |
| Kalia Security Vault Limited (KSVL) | Associated Entity | Organization | KSVL@cyber.net.pk |
| Hassan Jamal | Director of Operations | Person | hassan@backcheckgroup.com |
| Ahmed Ali Ansari | Asst. Manager Operations | Person | ahmed@backcheckgroup.com |
| Muhammad Sharjeel | Ex-employee / Victim | Person | sharjeel@backcheckgroup.com |
| Rasheed Ahmed Qureshi | IT Administrator | Person | rasheed.ahmed@backcheckgroup.com |
| SECP | Regulatory Authority | Organization | adjudication.headoffice@secp.gov.pk |
| FBR (Federal Board of Revenue) | Regulatory Authority | Organization | helpline@fbr.gov.pk |
| The Cleansheet Group FZCO | Client / Competitor | Organization | communication@tadkeek.com |
| Tadkeek Company LLC | Client / Payer | Organization | communication@tadkeek.com |
| Cyber Internet (Cybernet) | Vendor | Organization | Not in source |
| Xcluesiv Cloud Technology Pte Ltd | Vendor | Organization | vikash@xcluesiv.com |
| Standard Chartered Bank | Vendor / Bank | Organization | KYC.StandardChartered@sc.com |
| National University of Sciences & Technology (NUST) | Vendor / Recipient | Organization | Not in source |
| M&P Express Logistic | Vendor / Recipient | Organization | Not in source |
| Metro Pakistan (Private) Limited | Vendor | Organization | Not in source |
| National Foods Limited | Vendor / Recipient | Organization | Not in source |
| Habib Metropolitan Bank (HBL) | Financial Institution | Organization | hbl.ebank@hbl.com |
| Nasir Jatoi | IT Executive | Person | itsupport@backcheckgroup.com |
| Sumaiyyah Imran | Ghost Employee | Person | Not in source |
| Iqra Yousuf | Ghost Employee | Person | Not in source |
| Syeda Mehvish Ali (Mehwish Mumtaz) | Recipient / Antagonist | Person | s.mehvish.ali@gmail.com |
| Lt. Col. Saqib Mumtaz | Antagonist / Actor | Person | Not in source |
| Danish Iqbal Allahwala | Actor | Person | danishiqbal24@live.com |
| Asad Mahmood | Vendor / Actor | Person | asadmahmood@horizontech.biz |
| Danish Thanvi | Owner | Person | danish.thanvi@gmail.com |
| Mubashir Hussain | Senior Finance Executive | Person | mubashir@backcheckgroup.com |
| Hamza | Actor | Person | hamza@backcheckgroup.com |
| Kashif Wali | Finance Executive | Person | kashif@backcheckgroup.com |
| University of Karachi | Vendor / Recipient | Organization | Not in source |
| PTCL (Pakistan Telecommunication Company) | Vendor / Recipient | Organization | Not in source |
| K-Electric | Vendor / Recipient | Organization | Not in source |
| Unilever Pakistan Limited | Client / Vendor | Organization | Moiz.Khan@unilever.com |