{
  "name": "Uyghur Diaspora Group Targeted with Remote Surveillance Malware",
  "slug": "uyghur-diaspora-group-targeted-with-remote-surveillance-malware",
  "description": "Senior members of the World Uyghur Congress (WUC) were targeted by a sophisticated spear phishing campaign aimed at deploying surveillance malware. The attack, discovered in March 2025, involved a trojanized version of a legitimate Uyghur language text editor. The malware enabled remote surveillance, collecting system information and allowing file manipulation. The campaign's infrastructure consisted of two distinct command-and-control clusters, with domains impersonating the legitimate tool's developer. While not technically advanced, the operation demonstrated a deep understanding of the Uyghur community and likely aligns with Chinese government interests. The targeting of exiled Uyghur representatives highlights the ongoing cyber threats faced by diaspora groups.",
  "published": "2025-04-28T15:09:57+00:00",
  "created_at": "2025-04-28T15:09:57+00:00",
  "modified_at": "2025-04-28T17:20:52+00:00",
  "created_at_opencti": "2025-04-28T15:09:57+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-28",
    "remote access",
    "spear-phishing",
    "surveillance",
    "trojanized application",
    "uyghur",
    "uyghureditpp backdoor"
  ],
  "related_entities": {
    "malware": [
      {
        "id": "8dfd75fc-68b8-4cf1-a603-ccc04e9b94b6",
        "name": "UyghurEditPP backdoor",
        "slug": "uyghureditpp-backdoor"
      }
    ],
    "attack_patterns": [
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "China"
      }
    ]
  },
  "external_refs": [
    "https://www.infosecurity-magazine.com/news/uyghur-diaspora-surveillance",
    "https://otx.alienvault.com/pulse/680fb66576c0543e4fb545ff"
  ]
}