Tenzin Nydon
DHARAMSHALA, Oct. 15: Chinese state-linked cyber threat actors exploited the Tibetan spiritual leader His Holiness the Dalai Lama’s 91st birthday celebrations and other politically sensitive Tibetan events to conduct espionage operations against the Tibetan diaspora, including through malicious emails and a compromised Tibetan-language website, according to a report published by the Tibetan Computer Emergency Readiness Team (TibCERT).
The report, titled “His Holiness the Dalai Lama’s 91st Birthday: A Celebration Shadowed by China’s Transnational Repression Efforts,” published on October 7, documents two distinct cyber campaigns observed in the lead-up to and during the July 2026 celebrations.
TibCERT recorded 49 submitted incidents within the Tibetan community during the reporting quarter, warning that the figure likely understates the actual scale of the threat, given that many incidents may go unreported.
The report identifies one campaign assessed to be associated with Mustang Panda, a China-linked advanced persistent threat (APT) group, and a second campaign attributed to a China-nexus threat actor using a compromised Tibetan website to profile visitors and distribute malware.
The first campaign, active by May 2026, targeted prominent Tibetans, human rights organisations and civil society groups through emails containing malicious files hosted on Google Drive, according to TibCERT.
The emails used politically sensitive topics to lure recipients, including the Dalai Lama’s birthday, Lobga Rangzen’s self-immolation outside UN headquarters, the proposed US Assuring the Future of Tibet Act (AFTA), China’s “Ethnic Unity Law” and the Central Tibetan Administration’s President Penpa Tsering’s visit to Ladakh.
The downloaded files contained a Windows executable disguised as a PDF. Opening it displayed a harmless document while secretly running malicious code. Identified as associated with the LOTUSLITE backdoor, the malware could persist on infected computers and communicate with attacker-controlled servers. TibCERT traced its concealed command-and-control address to 154.216.3[.]62.
In a second campaign observed in July 2026, attackers gained access to a WordPress editor account and injected malicious JavaScript into 18 posts across multiple language sections of a Tibetan community website. The affected posts included articles dating back to 2011.
The scripts collected information about visitors’ devices, browsers and network settings before selectively displaying a deceptive download prompt to Windows users. This allowed attackers to target potential victims through a trusted community website rather than contacting each person individually.
The download, disguised as a video archive named video.zip, contained a malicious Windows shortcut that launched a trusted Microsoft executable modified to load an attacker-controlled file. This technique, known as DLL side-loading, helped conceal the malware.
TibCERT’s analysis found that the malware decrypted and ran an additional payload in computer memory, enabling remote surveillance and control while making detection more difficult. The incident highlights how compromised websites can be exploited to gather information about visitors and deliver malware to selected targets.
TibCERT situated the campaigns within a broader pattern of cyber operations targeting Tibetans beyond China’s borders. It argued that politically sensitive dates and events can create opportunities for surveillance and digital intrusion, particularly when attackers exploit community trust and the urgency surrounding current developments.
The report’s findings are significant for Tibetan organisations, journalists, activists and civil society groups whose work depends on email, websites and digital communication. A compromised device or account can expose sensitive correspondence and personal networks, while an infected community website can put visitors at risk without their knowledge.
The two campaigns also demonstrate different approaches to reaching potential victims. The first relied on carefully tailored emails and files tied to Tibetan political developments. The second used an already trusted website as a distribution channel, automating reconnaissance and selectively directing visitors towards a malicious download.
The report recommended that users take 30 seconds to check emails before clicking links or opening attachments. They should verify the sender’s actual email address, preview links, and be cautious of messages that create urgency or refer to sensitive political and community events.
The report added that suspicious emails should not be replied to and users should avoid using contact details provided in the message. Instead, they can forward them to support@tibcert.org for investigation.
For website administrators, TibCERT recommended providing staff with basic website security training, enabling two-factor authentication, and using browser extensions such as NoScript to block scripts on untrusted websites. The report also advised restricting file uploads to necessary, safe formats and blocking unnecessary executable and script files stating that these restrictions should be enforced on the server, rather than relying only on browser settings.
The post Dalai Lama’s birthday, politically sensitive events used to target Tibetans online, TibCERT warns. appeared first on Phayul.