A hacking group, believed to be Chinese state-sponsored, has targeted two websites associated with the Tibetan community in a recent cyberattack. The Tibet Post and Gyudmed Tantric University websites were compromised in an attempt to install malware on visitors' computers, as revealed by a cybersecurity firm's analysis.
The hackers, identified as TAG-112, manipulated the websites to prompt visitors to download a malicious file disguised as a security certificate. Once opened, the file installs Cobalt Strike Beacon malware on the user's computer, enabling activities such as key logging and file transferring.
