Loading story…
A cyber-espionage campaign targeted a small number of Uyghur individuals and Uyghur-supporting organizations in Xinjiang, Pakistan, and other parts of China using malicious documents and spoofed charity and human-rights websites. Researchers said the operation used United Nations-themed lures and fake domains including officemodel[.]org, unohcr[.]org, and tcahf[.]org to deliver Windows implants identified as WebAssistant and TcahfUpdate.
The malware collected host information, including system identifiers, running processes, and installed software, while also establishing persistence and retrieving additional payloads from attacker-controlled infrastructure. Investigators observed anti-VM behavior and possible checks for security tools, and attributed the activity with low-to-medium confidence to a Chinese-speaking threat actor based on the victimology and code clues; newly registered domains tied to the same infrastructure indicated the campaign remained active into 2021.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point Research and Kaspersky GReAT reported that the espionage campaign targeting Uyghur individuals and supporting organizations remained active into 2021. They linked newly registered domains to the same attacker infrastructure.
The same fake tcahf[.]org website later served a different Windows implant family, TcahfUpdate, indicating an evolution in the campaign's tooling. Researchers observed this second implant family in October 2020.
The fake Turkic Culture and Heritage Foundation website tcahf[.]org served a Windows implant family called WebAssistant to targets posing as a security scanner for grant applicants. Researchers observed this malware family on the site in May 2020.
The domain officemodel[.]org, used to deliver malicious templates from a UN-themed lure document, resolved to the same IP address as unohcr[.]org, a fake UN human-rights site. The shared infrastructure was observed between April and December 2020.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lookout disclosed multiyear Android surveillance campaigns tied to China-origin activity that targeted the Uyghur ethnic minority and, to a lesser extent, Tibetans, using spyware families including **SilkBean**, **DoubleAgent**, **CarbonSteal**, and **GoldenEagle**. The operations dated back to at least 2013 and relied on trojanized versions of legitimate apps that continued to function normally while covertly stealing contacts, messages, call records, device details, and location-related data for exfiltration to attacker-controlled infrastructure. Lookout linked the mobile activity to a broader surveillance toolkit that also included **HenBox**, **PluginPhantom**, **Spywaller**, and **DarthPusher**, and assessed that victims may have been affected across at least 14 countries, including Turkey, Kuwait, and Syria. Citizen Lab documented an earlier, highly targeted Android malware campaign against prominent Tibetans that used forged emails and trojanized **Kakao Talk** and **TuneIn Radio** APKs to compromise devices. The malware preserved normal app behavior but added hidden spying functions, including periodic beaconing to `android.uyghur.dnsd.me`, encrypted configuration retrieval, data uploads, and the ability to respond silently to SMS commands with cellular network and base-station identifiers. The findings from both organizations show a long-running pattern of mobile espionage delivered through phishing and fake third-party app stores rather than Google Play, with overlaps in Uyghur-themed infrastructure and lures pointing to sustained surveillance of dissident communities.
Aug 15, 2026
The UK National Cyber Security Centre and international government partners warned that the **BADBAZAAR** and **MOONSHINE** spyware families are being used to target mobile users linked to **Uyghur, Tibetan, Taiwanese, Hong Kong, Xinjiang, democracy, and Falun Gong** issues. The malware is delivered through trojanized Android and iOS apps that masquerade as legitimate software, sometimes impersonating brands such as **WhatsApp** and **Skype**, and has been spread via social media, messaging platforms, third-party download sites, and in some cases official app stores. Agencies said the targeting aligns with subjects the Chinese state views as threatening to its stability, and assessed that the stolen data would almost certainly be valuable to Beijing. The spyware can covertly collect messages, files, photos, device information, and location data, while also enabling access to microphones and cameras for real-time surveillance. The advisory cited examples including the **MOONSHINE** sample `ئاۋازلىق قۇرئان.apk` aimed at Uyghur users and the **BADBAZAAR**-linked **TibetOne** iOS app, supported by infrastructure such as `tibetone[.]org` and promoted through Telegram and Reddit. Officials urged at-risk users to install apps only from trusted sources, keep devices updated, avoid rooted or jailbroken phones, review app permissions regularly, and report suspicious links, accounts, and messages; a companion technical advisory also called on app store operators, developers, and social media companies to help detect and disrupt the campaign.
Aug 15, 2026
Researchers reported that the **Scarlet Mimic** threat group conducted a years-long mobile surveillance operation targeting the Uyghur community and associated activists, with activity traced from 2015 through at least mid-2022. The campaign used Android malware known as **MobileOrder**, delivered outside Google Play through social-engineering lures disguised as Uyghur-themed PDFs, images, and audio files, continuing a broader espionage pattern previously linked to Scarlet Mimic’s targeting of minority activists. Once installed, the spyware enabled extensive device monitoring and control, including data theft, location tracking, call and SMS abuse, call recording, ambient audio capture, screenshot collection, remote shell access, and installation of additional APKs. Researchers said the malware evolved over time with updated string obfuscation, dead-drop resolvers hosted on Sina blogs, **AES**-encrypted command-and-control traffic, and a move from the **AMAP SDK** to Android `LocationListener` for real-time tracking, reinforcing the assessment that Scarlet Mimic maintained a sustained and adaptive surveillance campaign against Uyghurs.
Aug 14, 2026