Windows Backdoor Targets Members of Exiled Uyghur Community

Researchers at the University of Toronto’s Citizen Lab uncovered a spear-phishing campaign targeting World Uyghur Congress members that delivered a Trojanized Uyghur language text editor (UyghurEditPP) via Google Drive links; the Windows backdoor collects system information, can download/upload files and run plugins, and uses a suspicious Microsoft-impersonating certificate with C2 infrastructure observed on Choopa LLC IPs. Active since mid-2024 with infrastructure movement through April, the campaign is attributed to likely China-aligned actors and highlights risks to diaspora and marginalized communities, along with recommendations to obtain software only from official, verified sources.