Forest Global Training Partners

Cyber Risks · Volexity Blog

Democracy in Hong Kong Under Attack

Summary: Volexity reported in October 2014 that it was tracking an advanced persistent threat operation using strategic web compromises of websites in Hong Kong and Japan, with malicious JavaScript added to legitimate code that served exploits and malicious Java Applets to install malware on visitors. The compromised sites included the Alliance for True Democracy (www.atd.hk) and both the English and Chinese Democratic Party Hong Kong sites (www.dphk.org, eng.dphk.org), which referenced the known-bad domain java-se.com, while the People Power site (www.peoplepower.hk) instead carried malicious iFrames using the Chinese URL shortener 985.so that redirected to exploit pages on Hong Kong IP address 58.64.178.77.

What you should know: Volexity could not retrieve the hostile o.js file because every request returned HTTP 403, suggesting the code was activated only at certain times or served to a whitelisted set of targets, so a clean scan from your network may prove nothing. The same java-se.com activity had already touched parts of the Japanese Nikkei in early September 2014, and the DPHK site had been used in a strategic web compromise once before, in May 2011.

Read the original at Volexity Blog ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026