Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs
Summary: Volexity reports that at least 11 Uyghur and East Turkistan websites have been compromised and used for surveillance and exploitation, with some continuously attacking visitors for at least four years. The activity includes Scanbox deployment on istiqlal.net in mid-April 2019 and Android exploit code, 22,963 bytes in size, that forces download of a 64-bit ARM executable exfiltrating device data to 149.28.207.244.
Why it matters: Volexity attributes most of this activity to at least two Chinese APT groups and tracks the Android targeting under the moniker Evil Eye, with the malware beaconing a hard-coded Accept-Language of zh-CN. For organizations serving diaspora or human rights communities, a compromised news site is the delivery mechanism, and visitors are the payload.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026