Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs

Volexity details a coordinated, ongoing cyber surveillance and exploitation campaign targeting the Uyghur diaspora: attackers compromised at least 11 Uyghur-related websites to deploy Scanbox profiling, OAuth-based Gmail credential access, doppelganger domains, and an Android exploit that delivers a 64-bit ARM loader which exfiltrates extensive device and subscriber data; activity is attributed to multiple Chinese APT groups and includes numerous IoCs and a network detection signature.