Illusory Wishes: China-nexus APT Targets the Tibetan Community
Essential information
- Published
- 23/07/2025 15:42
- Modified
- 23/07/2025 16:45
- Tags
- 2025-07-23 dll sideloading ghost rat multi-stage attack phantomnet social engineering tibetan community web compromise
- Related entities
- 26 observables, 1 intrusion sets (apt), 17 techniques (mitre), 2 malware, 2 others
Description
Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and PhantomNet backdoors. The attackers used social engineering tactics, impersonating legitimate platforms and leveraging culturally significant events to lure victims. Both campaigns employed sophisticated evasion techniques, including code injection and API hook bypassing. The attacks are attributed to China-nexus APT groups based on victimology, malware used, and employed tactics. The campaigns highlight the ongoing cyber threats faced by the Tibetan community and the evolving tactics of state-sponsored threat actors.