Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and PhantomNet backdoors. The attackers used social engineering tactics, impersonating legitimate platforms and leveraging culturally significant events to lure victims. Both campaigns employed sophisticated evasion techniques, including code injection and API hook bypassing. The attacks are attributed to China-nexus APT groups based on victimology, malware used, and employed tactics. The campaigns highlight the ongoing cyber threats faced by the Tibetan community and the evolving tactics of state-sponsored threat actors.

The threat known as "Illusory Wishes" involves two coordinated cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeting the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These campaigns are attributed to China-nexus Advanced Persistent Threat (APT) groups, based on the victimology, malware families used, and the tactics, techniques, and procedures (TTPs) observed. The attackers employed strategic web compromises to initially lure victims, leveraging social engineering techniques that impersonated legitimate platforms and exploited culturally significant events to increase the likelihood of user interaction and infection. The attacks utilized multi-stage infection chains, starting with web compromises leading to DLL sideloading—a technique where malicious DLLs are loaded by legitimate applications to evade detection. The deployed malware includes Ghost RAT and PhantomNet backdoors, both sophisticated tools enabling persistent remote access, data exfiltration, and further lateral movement within victim environments. The campaigns demonstrated advanced evasion techniques such as code injection and API hook bypassing to avoid detection by security solutions. The attack techniques align with multiple MITRE ATT&CK tactics and techniques, including T1113 (screen capture), T1033 (system owner/user discovery), T1056.001 (keylogging), T1123 (audio capture), T1204.002 (malicious file execution), T1573.001 (encrypted channel), T1574.001 (DLL side-loading), and others, indicating a comprehensive and stealthy approach to compromise and maintain persistence. These campaigns underscore the ongoing cyber threats faced by politically sensitive communities and the evolving capabilities of state-sponsored threat actors to conduct targeted espionage and surveillance operations.

Detailed information about Illusory Wishes: China-nexus APT Targets the Tibetan Community. Get real-time updates, technical details, and mitigation strategies.

Illusory Wishes: China-nexus APT Targets the Tibetan Community - Live Threat Intelligence - Threat Radar | OffSeq.com

Illusory Wishes: China-nexus APT Targets the Tibetan Community

Threats Tagged 'tibetan community'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'tibetan community'

Lead Pen Test Professional