PRC's Use of Mobile Surveillance for Tracking the Uighur population in China... | CYBERWARCON 2022

### Overview In this CYBERWARCON 2022 presentation, Christina, a threat intelligence researcher at Lookout, details roughly eight years of tracking mobile surveillance campaigns targeting the Uyghur population both within China (specifically the Xinjiang Uyghur Autonomous Region) and abroad, such as in Turkey and other Muslim-majority nations. Mobile surveillance is utilized to monitor individuals for so-called 'pre-criminal activities'—such as using VPNs, WhatsApp, or traveling abroad—that authorities use as pretexts for detention in re-education camps.

### Key Topics - **Targeting Context and the 'Five Poisons'**: The Chinese Communist Party views Uyghur and Tibetan separatists, Falun Gong practitioners, democracy advocates, and Taiwan independence supporters as regime threats due to domestic and international diaspora activism. In Xinjiang, resource importance and security control led to extensive camp detentions, with smartphones serving as prime surveillance vectors. - **Prolific Malware Families**: The talk covers the historical timeline of mobile surveillance dating back to Golden Eagle (2011), Double Agent, HenBox, and PluginPhantom, while focusing heavily on two active families: BadBazaar and Moonshine. - **Infiltration and Distribution Vectors**: Attackers distribute trojanized applications (e.g., Uyghur dictionaries, prayer apps, Turkish mapping tools, WhatsApp, TikTok) through extensive social engineering on Uyghur-language Telegram channels, spear-phishing, fake app stores, and unofficial platforms like APKPure.

### Technical Details - **BadBazaar**: - Attributed to APT15 and previously misclassified as Bahamut. Overlaps in C2 infrastructure with Double Agent and ties to a digital quartermaster email address. - Architecture: Lightweight dropper that dynamically retrieves its primary surveillance payload from the C2 (moving away from bundling payload in `update.jar`). - Capabilities: Exfiltrates location, call logs with geocoding, SMS, pictures, Word/PowerPoint files, and conducts call recording. - Network Infrastructure: Employs SSL pinning using reused certificates bearing the common name `myServer`. Subdomains match trojanized app names (e.g., `tel.*`), registered via eNom, hosted on Hetzner, and communicate over ports 20121 or 20122. - **Moonshine**: - Attributed to Poison Carp; originally disclosed by Citizen Lab in 2019 targeting Tibetan activists via spear-phishing. - Architecture: Uses a native library (`libout`, formerly `libverben.so`) to extract a module named `Scotch`. Based on device permissions, it calculates a vulnerability score sent to C2 to determine command and exfiltration strategy. - Modules: Downloads four secondary modules; recently added capabilities to exfiltrate WeChat databases alongside microphone and call recording. - Network Infrastructure: Admin panels titled `Scotch Admin` (previously `Whiskey Admin`), hosted primarily in Singapore via Hostinger and dynamic DNS. Code checks connectivity to Baidu and Chinese IPs, and web app API documentation is written in simplified Chinese. - **Contractor Attribution**: Identifies domestic contractors tied to surveillance tooling, including Beijing Best United Technology Co., Ltd. (PluginPhantom), Xi'an Tianhe Defense Technology Co., Ltd. (Golden Eagle), and Astronomical Point Network Technology Company (language recognition tooling).

### Takeaways Surveillance tooling against the Uyghur diaspora has evolved to be highly operational, featuring fully functional apps, robust social engineering, and persistent presence in community channels. The speaker anticipates continued increases in technical sophistication, accelerated by domestic vulnerability disclosure laws and ongoing state-level targeting.