Cybersecurity researchers are warning of two simultaneous espionage operations by Chinese hackers—codenamed “Operation Chat” and “Operation PhantomPrayers”—that were activated a few weeks before the Dalai Lama’s 90th birthday, taking advantage of increased traffic to Tibet-themed websites to infect Windows systems with sophisticated backdoors.
See also: China's Salt Typhoon hacked the US National Guard
The attackers compromised a legitimate greetings page and, by quietly replacing its hyperlink, redirected visitors to nearby domains under niccenter[.]net, where fake installers disguised as Tibetan chat tools awaited unsuspecting users.
Once executed, the packages installed either the Ghost RAT or the newer PhantomNet, giving attackers a wide range of surveillance capabilities, including access to files, cameras, microphones, and even system shutdown control. The scheme relies on multi-stage loaders that abuse the DLL sideloading via signed executables— Element.exe for GhostChat and VLC.exe for PhantomPrayers—by faking valid certificates to bypass signature checks.
From there, shellcode is injected into the harmless ImagingDevices.exe, maps a new copy of the ntdll.dll and replaces the user-mode hooks, before reflexively loading the main trojan.
See also: Chinese group "Earth Lamia" targets multiple industries
Zscaler analysts pointed out that both campaigns rely on low-level Nt* and Rtl*, avoiding common Win32 APIs — a choice intended to evade most endpoint detection mechanisms.
The Ghost RAT communicates with the address 104.234.15[.]90:19999 via a custom TCP protocol called “KuGou”, encrypting packets with a modified version of the RC4 algorithm, which is also used to hide the configuration on disk.
PhantomNet, in contrast, supports either a simple TCP or HTTPS connection to the address 45.154.12[.]93:2233, wrapping the traffic with AES encryption and a dynamically generated key.
Each implant is extended with additional DLL plugins that are loaded on demand—encrypted with XOR or AES until the moment of loading—providing capabilities such as remote shell, keylogging, clipboard interception, and full registry manipulation.
See also: Czech Republic accuses Chinese hackers of attack on Foreign Ministry
Overall, the breaches demonstrate how techniques such as supply-chain sideloading and living land remain powerful tools for espionage groups seeking a long-term presence in diaspora communities.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
