A Chinese state-sponsored hacking group has breached two Tibetan-linked websites, aiming to deploy spyware and collect sensitive user data, according to cybersecurity firm Insikt Group.
The compromised sites, Tibet Post and Gyudmed Tantric University, were used to trick visitors into downloading malware disguised as a security certificate. This attack, linked to the group TAG-112, aligns with past cyber-espionage efforts targeting Tibetan communities.
China denies involvement, maintaining it opposes state-sponsored hacking. However, Insikt Group found similarities with TAG-102, an established hacking group tied to Chinese intelligence.
The attacks, aimed at organizations opposing Beijing, reflect broader efforts to monitor Tibetan independence advocates and human rights groups. The university has resolved the issue, but the news site remains compromised.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.