Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and PhantomNet backdoors. The attackers used social engineering tactics, impersonating legitimate platforms and leveraging culturally significant events to lure victims. Both campaigns employed sophisticated evasion techniques, including code injection and API hook bypassing. The attacks are attributed to China-nexus APT groups based on victimology, malware used, and employed tactics. The campaigns highlight the ongoing cyber threats faced by the Tibetan community and the evolving tactics of state-sponsored threat actors.

The threat known as "Illusory Wishes" involves two coordinated cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeting the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These campaigns are attributed to China-nexus Advanced Persistent Threat (APT) groups, based on the victimology, malware families used, and the tactics, techniques, and procedures (TTPs) observed. The attackers employed strategic web compromises to initially lure victims, leveraging social engineering techniques that impersonated legitimate platforms and exploited culturally significant events to increase the likelihood of user interaction and infection. The attacks utilized multi-stage infection chains, starting with web compromises leading to DLL sideloading—a technique where malicious DLLs are loaded by legitimate applications to evade detection. The deployed malware includes Ghost RAT and PhantomNet backdoors, both sophisticated tools enabling persistent remote access, data exfiltration, and further lateral movement within victim environments. The campaigns demonstrated advanced evasion techniques such as code injection and API hook bypassing to avoid detection by security solutions. The attack techniques align with multiple MITRE ATT&CK tactics and techniques, including T1113 (screen capture), T1033 (system owner/user discovery), T1056.001 (keylogging), T1123 (audio capture), T1204.002 (malicious file execution), T1573.001 (encrypted channel), T1574.001 (DLL side-loading), and others, indicating a comprehensive and stealthy approach to compromise and maintain persistence. These campaigns underscore the ongoing cyber threats faced by politically sensitive communities and the evolving capabilities of state-sponsored threat actors to conduct targeted espionage and surveillance operations.

Detailed information about Illusory Wishes: China-nexus APT Targets the Tibetan Community. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'ghost rat'

Filter Threats

Threats Tagged 'ghost rat'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility