TZUTC: -0500   
   MSGID: 955.consprcy@1:2320/105 2c5d1586   
   PID: Synchronet 3.20a-Linux master/acc19483f Apr 26 202 GCC 12.2.0   
   TID: SBBSecho 3.20-Linux master/acc19483f Apr 26 2024 23:04 GCC 12.2.0   
   BBSID: CAPCITY2   
   CHRS: ASCII 1   
   Spyware combing for data 'of use to China' hidden inside religious and   
   cultural apps   
      
   Date:   
   Wed, 09 Apr 2025 19:03:00 +0000   
      
   Description:   
   Experts warn spyware is being loaded into cultural and religious apps to   
   gather data.   
      
   FULL STORY   
      
   The UKs National Cyber Security Center, alongside compatriots in Australia,   
   Canada, Germany, New Zealand and the US, are warning apps loaded with spyware   
   are being used to target Uighur, Tibetan and Taiwanese communities.    
      
   The spyware, named BADBAZAAR and MOONSHINE, is likely being used to gather   
   information of use to China on individuals who could pose a threat to Chinas   
   security.    
      
   Many of the apps loaded with spyware are designed to mimic religious or   
   cultural applications.    
      
   Gathering location, audio and photo data   
      
   The apps in question include Audio Quran, a religious app used to target   
   Uighur communities, and TibetOne which appears at first glance to be an   
   application used to share images, videos, music, and articles celebrating   
   Tibetan culture.    
      
   There have been attempts to share the applications through legitimate    
   channels such as the Google Play Store, but these attempts have largely been   
   unsuccessful thanks to the security controls in place on the Play Store.    
      
   As a result, the apps were instead shared on forums frequented by the target   
   communities, and relied on users installing the apps through .apk files.    
      
   According to the NCSC report [ PDF ], the apps arent just being used to    
   target individuals, but are also being used to monitor civil society groups    
   to track their activities.    
      
   The BADBAZAAR and MOONSHINE spyware would be able to access real time    
   location and gps data, live audio and video capture, files stored on the   
   device, SMS and call logs, and device information, as well as being able to   
   play audio through the device.    
      
   The joint statement says, Although BADBAZAAR and MOONSHINE have been observed   
   targeting Uighur, Tibetan and Taiwanese individuals, there are other malware   
   that target other minority groups in China. Citizens from co-sealing nations,   
   in China and abroad, who are perceived to be supporting causes that threaten   
   regime stability are almost certainly under threat from mobile malware such    
   as BADBAZAAR and MOONSHINE.    
      
   The capability to capture location, audio and photo data almost certainly   
   provides the opportunity to inform future surveillance and harassment   
   operations by providing real-time information on the targets activity.   
      
   ======================================================================   
   Link to news story:   
   https://www.techradar.com/pro/security/spyware-combing-for-data-of-use-to-chin   
   a-hidden-inside-religious-and-cultural-apps   
      
   $$   
   --- SBBSecho 3.20-Linux   
    * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)   
   SEEN-BY: 105/81 106/201 128/187 129/305 153/7715 154/110 218/700 226/30   
   SEEN-BY: 227/114 229/110 111 114 206 300 307 317 400 426 428 470 664   
   SEEN-BY: 229/700 705 266/512 291/111 320/219 322/757 342/200 396/45   
   SEEN-BY: 460/58 712/848 902/26 2320/0 105 3634/12 5075/35   
   PATH: 2320/105 229/426