The group is targeted in spy campaigns under the guise of the United Nations
The Uyghur community in China and Pakistan was the target of an ongoing espionage campaign by tricking them to download a Windows backdoor to collect sensitive information from their systems.
According to researchers from Check Point Research (CPR) and Kaspersky’s GReAT team, the campaign abused United Nations (UN) branding to target the victims.
The targets were the Uyghurs, a Turkic ethnic minority found in Xinjiang, China and the campaign was believed to be the work of a Chinese-speaking threat actor.
The targets are sent phishing documents that are branded with the United Nations’ Human Rights Council (UNHRC) logo. The document, which has been named UgyhurApplicationList.docx, contains decoy material relating to discussions of human rights violations.
If the victim enables editing on opening the file, VBA macro code checks the PC’s architecture and downloads either a 32- or 64-payload.
The file dubbed “OfficeUpdate.exe,” is shellcode that fetches and loads a remote payload, but at the time of analysis, the IP was unusable. However, the domains linked to the malicious email attachment expanded the investigation further to a malicious website used for malware delivery under the guise of a fake human rights organization.
The “Turkic Culture and Heritage Foundation” (TCAHF) domain claims to work for “Tukric culture and human rights,” but the copy has been stolen from opensocietyfoundations.org, a legitimate civil rights outfit.
This website, directed at Uyghurs seeking funding, tries to lure visitors into downloading a “security scanner” prior to filing the information required to apply for a grant. But the software is actually a backdoor.
The website offered a macOS and Windows version but only the link to the latter downloaded the malware.
Two versions of the backdoor were found; WebAssistant that was served in May 2020, and TcahfUpdate which was loaded from October. The backdoors establish persistence on victim systems, conduct cyberespionage and data theft, and may be used to execute additional payloads.
Victims are located in China and Pakistan in regions mostly populated by Uyghurs.
