VERY IMPORTANT

This report analyzes a malware campaign active between January to March 2018 that targeted Tibetan activists, journalists, members of the Tibetan Parliament in exile, and the Central Tibetan Administration. We detail a successful intrusion of a Tibetan NGO and provide a brief analysis of the operator’s actions post-infection. This recent campaign, as well as a campaign we reported in 2016, both have connections to a wider operation called “Tropic Trooper”. The strength and meaning of these connections is assessed. We examine the challenges associated with investigating closed espionage ecosystems and the importance of accurately describing the players and the harms they cause.