{"id":36097,"date":"2020-07-15T21:50:19","date_gmt":"2020-07-15T21:50:19","guid":{"rendered":"http:\/\/fdbabf98-6f21-4582-b28c-ce61ca506940"},"modified":"2020-07-15T21:50:19","modified_gmt":"2020-07-15T21:50:19","slug":"chinese-state-hackers-target-hong-kong-catholic-church","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/chinese-state-hackers-target-hong-kong-catholic-church\/","title":{"rendered":"Chinese state hackers target Hong Kong Catholic Church"},"content":{"rendered":"
\"catholic<\/span>
<\/span> Image: Mateus Campos Felipe <\/span><\/figcaption><\/figure>\n

China’s government hackers have targeted members of the Hong Kong Catholic Church in a series of spear-phishing operations traced back to May this year.<\/p>\n

The attacks have come to light after reports [1<\/a>, 2<\/a>, 3<\/a>] that some of Hong Kong’s church leaders and clergy have been directly involved in supporting pro-democracy protests despite orders from the Vatican to remain neutral.<\/p>\n

The spear-phishing campaign fits recent reports that Chinese government hacking groups focusing cyber-espionage efforts on the Hong Kong region after pro-democracy protests begun last year [1<\/a>, 2<\/a>].<\/p>\n

The spear-phishing campaign<\/h3>\n

The current attacks were revealed earlier this week by a malware analyst who goes online by the pseudonym of Arkbird<\/a>.<\/p>\n

In an interview, the researcher told ZDNet <\/em>he discovered malware samples typically associated with Chinese state groups uploaded on VirusTotal.<\/p>\n

The malware files were ZIP and RAR archives containing Windows executable files [1<\/a>, 2<\/a>, 3<\/a>].<\/p>\n

According to sandbox analysis, unpacking and running the files starts a legitimate app like Microsoft Word or Adobe Reader.<\/p>\n

<\/section>\n

The legitimate apps load a lure document, such as communications from Vatican officials or news articles from the Union of Catholic Asian News<\/a>, a news portal dedicated to tracking the affairs of the Catholic church and communities across Asia.<\/p>\n

\"hk-apt-lure.png\"<\/span>