Turkistanpress

Turkistanpress operates under the alias Turkistanpress and is headquartered in China. The organization entered the public record in 2019 when it was identified as a target of a large‑scale digital surveillance campaign. The campaign was attributed to Chinese advanced persistent threat (APT) groups. It focused on minority diaspora communities and aimed to compromise online assets linked to their cause. According to the reported incident, more than eleven websites associated with the group were breached. The attackers sought to gather intelligence and maintain persistent access to the victims’ communications. This incident highlights that the organization maintains online assets. The scale of the operation indicates that Turkistanpress maintains a notable digital footprint. The targeting suggests that the organization is perceived as a conduit for information relevant to the diaspora. No further details about its size, staffing, or commercial activities are publicly disclosed in the available sources.

The attackers deployed the Scanbox framework to profile visitors to the compromised sites. They also used Android‑based exploits to deliver ARM executables onto mobile devices. Doppelganger domains were created to imitate legitimate services such as Turkistan Times. These fraudulent domains were used to harvest credentials from unsuspecting users. Google OAuth was abused to gain unauthorized access to victims’ Gmail accounts. Through OAuth, the threat actors could monitor email content, contacts, and other Google‑linked data. Mobile device users were a particular focus, with malware designed to persist on smartphones and tablets. The combined web and mobile vectors enabled extensive data collection across multiple platforms. Persistent monitoring allowed the APT groups to track communications and contacts over time. The campaign illustrates the types of threats faced by organizations that serve minority communities online.