East Turkestan Cultural Center

The organisation known by the alias East Turkestan Cultural Center has been referenced in cybersecurity reporting as a target of state‑linked threat activity.
The reporting links the organisation to the Uyghur diaspora community.
This connection emerged from a specific incident documented in open‑source threat intelligence.

The incident occurred on 3 September 2015.
Chinese state‑linked threat actors were identified as the perpetrators.
Their campaign focused on compromising online assets associated with the Uyghur diaspora.

The attackers used compromised websites as a primary vector for delivering malicious content.
They also established malicious infrastructure to host and distribute exploit tools.
Android exploits were deployed to target mobile devices of potential victims.
The Scanbox framework was employed to gather behavioural data from compromised browsers.
Deceptive domains that mimicked legitimate services were created to lure users into divulging credentials.

The overall aim of the operation was to conduct surveillance and exfiltrate data from the targeted population.
Unauthorized access to Gmail accounts was achieved through the abuse of OAuth tokens.
This allowed the threat actors to read email, access contacts, and potentially manipulate account settings.
The campaign resulted in extensive monitoring of the victims’ digital activities over an extended period.

The incident illustrates how cultural and community organisations can be leveraged as focal points for broader espionage efforts.
It also highlights the use of diverse technical tactics, ranging from web‑based exploits to mobile‑specific payloads, in a single operation.
Understanding such patterns assists defenders in recognizing similar targeting strategies against diaspora and advocacy groups.
Indicators of compromise related to the malicious domains and infrastructure have been shared publicly to aid detection efforts.
Organisations serving similar communities are encouraged to review their web and mobile security posture in light of these tactics.