Cyberattack against Uyghur rights activists shows hallmarks of Chinese repression tactics, researchers say

Indonews Digital

Chinese-Linked Hackers Target Uyghur Activists with Spyware Disguised in Email

Toronto — Digital security researchers at the University of Toronto’s Citizen Lab have revealed that threat actors likely linked to the Chinese government attempted to infiltrate the devices of a group of Uyghur activists using malicious surveillance software hidden in an email, according to a new report.

The malware was disguised as an altered version of a Uyghur-language word processing and spell-check tool. The researchers said this failed cyberattack, which targeted activists affiliated with the Munich-based World Uyghur Congress, appeared to be part of Beijing’s ongoing transnational repression campaign — including online surveillance and intimidation — against the Turkic ethnic group native to China’s northwest Xinjiang region. The Uyghurs have long faced discrimination and human rights violations, including mass detention, by Chinese authorities.

“Such attacks are, of course, annoying, and they show that we are fighting against a brutal Chinese government that is trying by all means to erase our voice,” said Erkin Zunun, one of the activists, in an interview with the International Consortium of Investigative Journalists (ICIJ) and Paper Trail Media. “We are trying to be a voice for the voiceless, but China is trying to suppress that too.”

Citizen Lab, an academic research center focused on studying digital threats, began analyzing the malware after the activists reached out to its researchers, as well as to Paper Trail Media reporters investigating Beijing’s tactics to silence its critics abroad as part of ICIJ’s China Targets investigation.

According to the Citizen Lab report, members of the World Uyghur Congress have frequently been targeted by cyberattacks from the Chinese state and its proxies. By analyzing the traces left by the malware and comparing them with previous attacks, researchers identified tactics, techniques, and patterns that “align closely with activities of the Chinese government.”

“The ruse employed by the attackers replicates a typical pattern,” the Citizen Lab report stated. “Threat actors likely aligned with the Chinese government have repeatedly instrumentalized software and websites designed to support marginalized and repressed cultures to digitally target these same communities.”

The Chinese Embassy in Germany did not respond to Paper Trail Media’s request for comment regarding the alleged attack.

ICIJ’s China Targets investigation is a collaboration of 43 media partners across 30 countries, exposing the mechanics of the Chinese government’s global repression campaign against its perceived enemies — and the failure of governments and international organizations to stop it. The investigation is based on interviews with 105 victims in 23 countries, secret video and audio recordings of police interrogations, internal Chinese documents, and other evidence.

Half of those interviewed reported that they believed they were followed or targeted by surveillance or spying operations by Chinese officials or their proxies; 27 said they were victims of online smear campaigns, and 19 reported receiving suspicious messages or experiencing hacking attempts, including by state actors.

Sowing Fear and Uncertainty

In early March, Erkin Zunun and other members of the World Uyghur Congress, which advocates for the rights of the Muslim-majority Uyghur people, received a seemingly friendly email wishing them a blessed Ramadan. “Ramadan Mubarak!” the email greeting read.

The sender claimed to be from one of the World Uyghur Congress’ partner organizations and asked the activists to install and test software that enables users to write in Uyghur, a Turkic language with an Arabic-derived alphabet.

Refrence: https://www.icij.org/investigations/china-targets/cyberattack-against-uyghur-rights-activists-shows-hallmarks-of-chinese-repression-tactics-researchers-say/