ILLUSORY WISHES: CHINA-NEXUS APT TARGETS THE TIBETAN COMMUNITY

Summary from the TLDR InfoSec newsletter

A China-linked Advanced Persistent Threat (APT) group launched "Operation GhostChat," targeting the Tibetan community by compromising legitimate websites and replacing them with malicious replicas that offer a backdoored version of the Element encrypted messaging app. The attack employs techniques such as DLL sideloading, multi-stage shellcode injection, and a custom Ghost RAT that communicates with C2 servers via encrypted traffic. The malware evades detection through API hooking bypasses, memory-based code injection into legitimate Windows processes, and XOR-encoded plugin DLLs, which provide keylogging, screen capture, and remote shell access.