Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans - The Citizen Lab

This report documents Scarlet Mimic’s long-running espionage campaign against Tibetan communities, tracing how attackers evolved from document-based malware to credential phishing that leverages cloud services to harvest Google credentials, and mapping how their infrastructure was repurposed for phishing campaigns; it includes detailed campaigns from 2013–2014 and a 2015 phishing wave, with indicators of compromise and defensive recommendations.