← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Weaponized Words: Uyghur Language Software Hijacked to Deliver Malware - The Citizen Lab
WHITE CyberHunter_NL 2025-05-01 Modified: 2025-05-31
13
IOCs
MEDIUM VOLUME
malwarechinaspearphishinguyghuruyghursxinjianggooglecitizen labmarchuyghur languageuyghur diasporaworld uyghurjuneaprilfebruaryvirustotalmediazeroandroidmunichassemblyservicedownloadfinalmajor
Indicators of Compromise (13)
All FileHash-SHA256 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 70af9a31d4470502a39d71ca566d604317a5ecbf9181a64379c9ee761e2f95ab — 2025-05-01
FileHash-SHA256 94a87dadeaac24bbc26c85d032b86a45cfd131516666e8e5d888f78986d1e993 — 2025-05-01
FileHash-SHA256 a9e76af3f3b04b9dd65e2e4dec8d5b00f8f67b420809da8b742651cc86e4270f — 2025-05-01
FileHash-SHA256 d6874907d0e558cba614313c60b84c912b10ca3c539661a3885daaadb1cb2b2b — 2025-05-01
URL https://tengri.ooguy.com/gheyret/Update — 2025-05-01
domain gheyret.com — 2025-05-01
domain gheyret.net — 2025-05-01
domain heyret.com — 2025-05-01
domain ooguy.com — 2025-05-01
domain uheyret.com — 2025-05-01
hostname anar.gleeze.com — 2025-05-01
hostname tengri.ooguy.com — 2025-05-01
hostname wanar.gleeze.com — 2025-05-01
References (1)
↗ https://citizenlab.ca/2025/04/uyghur-language-software-hijacked-to-deliver-malware/