Chinese government hackers have targeted members of the Catholic Church in Hong Kong in a spear-phishing campaign that took place in May.
The attacks were revealed after reports said some of Hong Kong's leaders and clergy had been directly involved in supporting pro-democracy protests, despite Vatican orders to remain neutral.
The spear-phishing campaign is said to have been carried out by Chinese government hacking groups who wanted to spy on Hong Kong religious leaders, following the pro-democracy protests.
Spear-phishing campaign
The current attacks were revealed earlier this week by a malware analyst known online by the pseudonym Arkbird.
In an interview, the researcher said he discovered malware samples commonly used by Chinese hacking groups. The samples were uploaded to VirusTotal.
The malware files were ZIP and RAR and contained Windows executable files.
According to the analysis, executing the files triggers a legitimate application, such as Microsoft Word or Adobe Reader.
Legitimate apps load a document, such as a message from Vatican officials or news articles from the Union of Catholic Asian News, a news portal that presents issues and affairs of the Catholic Church and its communities across Asia.
Arkbird says that alongside the legitimate applications and decoy documents, a malicious DLL file, which installs malware on the computer , using a technique known as DLL-sideloading.
Fred Plan, an analyst at US security FireEye, said that Chinese hackers have been using this particular version of DLL-sideloading for years.
Plan, who reviewed Arkbird's findings, said the payload was malware known as PlugX, a trojan that allows attackers to take control of victims' devices.
Arkbird attributed the malware samples to a group known as Mustang Panda, a Chinese hacking group known for its use of DLL-sideloading techniques, but also for targeting religious groups. This appears to be the case with the attack on members of the Catholic Church.
We still have no comment from a representative of the Catholic Diocese of Hong Kong.
The complicated China-Vatican relations
Relations between China and the Vatican have improved in recent years, but they are still “strange.” They broke off all diplomatic ties in 1951. At that time, Beijing’s newly established communism began to destroy all religious groups in order to bring local leadership structures under Communist Party control.
After the fall, China began appointing its own chief bishops throughout the country, a move that divided the Chinese Catholic community.
A portion continued to attend official government churches with party-imposed bishops, while the rest chose “underground churches” – unrecognized by China and the Vatican.
Relations between China and the Holy See began to improve in the 2000s, as China became a little more conciliatory and both sides began negotiating a cooperation agreement.
The agreement, signed in September 2018, allowed the Pope to continue to control the affairs of the Catholic Church, with the power to appoint bishops, who must, however, also be approved by the Communist Party.
This agreement is due to be renewed in September, and many officials of the Holy See in Hong Kong have felt they should not publicly support the protests, fearing that the Chinese leadership could isolate the Chinese Catholic community again.
