China’s surveillance campaigns targeting Uyghurs: Report

Cybersecurity researchers have uncovered two new surveillance campaigns that are targeting Uyghurs in China and abroad, including messaging services, prayer time apps, and dictionaries, according to a Lookout report citing its Threat Lab.
The two new surveillance campaigns were named BadBazaar and MOONSHINE by the researchers on Thursday. The other employs a previously disclosed tool, Moonshine, which was discovered by Citizen Lab and observed targeting Tibetan activists in 2019. The surveillance and detainment campaigns against Uyghurs and other Turkic ethnic minorities have been operational for years, but they got the spotlight when the United Nations Human Rights Commissioner, Michelle Bachelet, released her report in August, which stated that China has committed “serious human rights violations” against the Uyghur and “other predominantly Muslim communities” in Xinjiang Uyghur Autonomous Region (XUAR).
Published on Bachelet’s final day of her four-year term in office, the report said that the violations have taken place in the context of the Chinese government’s assertion that it is targeting terrorists among the Uyghur minority with a counter-extremism strategy that involves the use of so-called Vocational Educational and Training Centers (VETCs), or re-education camps.
On 31 October, 2022, about 50 countries submitted a joint statement to the UN General Assembly condemning the Chinese government’s oppression of Uyghurs and other Turkic peoples in East Turkistan.
According to the East Turkistan Government in Exile (ETGE), the joint statement issued on Monday is the largest group of states publicly condemning China’s ongoing atrocities in East Turkistan.
Many of the “pre-criminal” activities, which the authorities in Xinjiang consider indicative of religious extremism or separatism, can be tracked using mobile surveillance tools such as BadBazaar and MOONSHINE. Some activities that may result in a user being detained include using a VPN, communicating with practising Muslims abroad, using religious apps, and using certain messaging apps like WhatsApp that are popular outside of China, according to the report by the San Francisco-based cloud security firm.
BadBazaar and these new variants of MOONSHINE add to the already extensive collection of unique surveillance tools used in campaigns to surveil and subsequently detain individuals in China. Their continued development and prevalence on Uyghur-language social media platforms indicates that these campaigns are ongoing and that the threat actors have successfully infiltrated online Uyghur communities to distribute their malware.