Information about a long­running espionage campaign against the Tibetan community

This report describes the latest iteration in a longrunning espionage campaign against the Tibetan community. We detail how the attackers continuously adapt their campaigns to their targets, shifting tactics from documentbased malware to conventional phishing that draws on “inside” knowledge of community activities. This adaptation appears to track changes in security behaviors within the Tibetan community, which has been promoting a move from sharing attachments via email
to using cloudbased file sharing alternatives such as Google Drive.