It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community

Citizen Lab documents a targeted espionage campaign against Tibetan Parliamentarians in 2016 that used weaponized .rtf attachments (CVE-2012-0158 and CVE-2015-1641) to install variants of the custom KeyBoy backdoor; the report details infection chains, KeyBoy capabilities and evolution (config encoding, header changes, persistence methods), C2 infrastructure, sample hashes and other IOCs to support detection and response.