Cyber Incident Victim: Istiqlalhaber
Date:
Aug 2019
Location:
China
Summary
Chinese APT groups conducted extensive cyber operations targeting a minority ethnic group, compromising numerous diaspora-related websites to deploy surveillance tools and exploitation frameworks. Attackers utilized malicious code injections, Scanbox profiling, and Android exploits to monitor victims and steal data, while employing deceptive domains mimicking legitimate services like Google and Uyghur organizations. The campaigns facilitated unauthorized access to Gmail accounts via OAuth abuse and leveraged multiple attack vectors including mobile device compromises. These coordinated efforts enabled persistent digital surveillance, contact harvesting, and intelligence gathering against the community.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Between 2019 and prior years, Chinese state-sponsored advanced persistent threat (APT) groups conducted extensive cyber operations targeting the Uyghur diaspora, particularly those advocating for East Turkistan independence. These campaigns involved the strategic compromise of at least 11 Uyghur and East Turkistan-related websites, which were modified to host malicious code enabling surveillance and exploitation of visitors. Attackers injected unauthorized JavaScript into compromised sites to deploy the Scanbox framework, which profiled visitors' browser configurations, geolocations, and network information while attempting to exploit vulnerabilities for further access. Simultaneously, Android mobile device users were targeted through exploits delivering 64-bit ARM executables, indicating capabilities for persistent device compromise. The attackers also abused Google's OAuth implementation, creating deceptive authorization prompts to harvest Gmail credentials and access victims' email content and contact lists.
The operation utilized sophisticated infrastructure including doppelganger domains mimicking legitimate services like Google, the Turkistan Times, and the Uyghur Academy to enhance phishing credibility. Attackers employed IP addresses encoded in decimal notation within their malicious scripts to obscure command-and-control server locations. Forensic evidence linked these activities to at least two distinct Chinese APT groups, though specific group names weren't disclosed. These coordinated efforts enabled broad monitoring of Uyghur activists' communications, movements, and associations through both web-based and mobile attack vectors. The campaigns formed part of a long-term digital suppression strategy against Uyghur communities, complementing physical persecution measures documented in Xinjiang. No victim remediation efforts or technical countermeasures were described in the available reporting.