Google (imitated domain)

Profile narrative

The organisation conducts cyber espionage campaigns aimed at the Uyghur diaspora. It compromises websites and builds malicious infrastructure to deliver surveillance tools. A core component of its toolkit is the Scanbox framework, which profiles victims and facilitates the delivery of Android exploits. To harvest credentials, the group creates imitated domains that resemble legitimate Google services. These lookalike sites are used in OAuth phishing schemes that trick victims into granting unauthorized access to their Gmail accounts. Once access is obtained, attackers can read emails, extract contact lists, and monitor communications. The operation also involves direct exploitation of mobile devices to expand surveillance reach. By combining web‑based and mobile vectors, the group achieves large‑scale digital surveillance of its targets.

The activity is distinguished by a focus on ethnic minority populations rather than broad commercial or governmental targets. Its use of Google‑imitated domains highlights a specialization in social engineering that leverages trusted brand imagery. Reliance on OAuth token theft, rather than traditional password harvesting, shows a nuanced understanding of modern authentication mechanisms. Technical analysis has linked the infrastructure and tactics to Chinese advanced persistent threat (APT) groups, indicating a likely state‑aligned sponsorship. The sustained nature of the campaign, dating back to at least 2013, reflects a long‑term commitment to intelligence gathering on the Uyghur community. Headquartered in China, the organisation operates from a base that aligns with the geographic origin of the attributed threat actors. No public information discloses its corporate structure, ownership, or subsidiary relationships, so those details remain undetermined.

Incidents

1 incident linked to this organisation.