We are tracking a campaign targeting human rights activists working on Hong Kong and Xinjiang. The tactics are low technology but very persistent and has continued for at least 12 months across a number of countries. 1
#cybersecurity #HK #Xinjiang

Most of the targets have been activists. Some attacks include the creation of fake email addresses and impersonation. Other tactics include standard Business Email Compromise attacks. The attackers operate primarily out of China. 2

Some of the recipients of these fake emails are highly vocal pro-China actors, with a history of persistent targeting of activists. They have been receiving emails appearing to be from activists but are being sent by the threat actor in an attempt to discredit them. 3

The fact that the threat actor had the email addresses of a large number of the pro-PRC actors compiled for this campaign is a telling indicator of the community they may have emerged from. 4

The attacks also coincide with significant bot targeting of activist social media campaigns. This includes tagging in thousands of posts by twitter bots, essentially DDoSing activists from being able to track social media. 5