China Hackers Used Trojanized UyghurEditPP App to Target Uyghur Activists

Citizen Lab reported a targeted spear-phishing campaign (March 2025) that delivered a Trojanized UyghurEditPP application to World Uyghur Congress members and activists; the backdoor harvested system identifiers and communicated with two distinct command-and-control clusters (domains mimicking the tool and Dynu-registered subdomains) allowing file transfer and remote plugin execution. Infrastructure overlap (shared Microsoft certificate, Choopa-hosted IPs), high-quality social engineering, and ties to transnational repression support probable Chinese state involvement.