Ddos 
An investigation by The Citizen Lab, in collaboration with the International Consortium of Investigative Journalists (ICIJ), has unmasked a sophisticated dual-actor campaign aligned with the People’s Republic of China (PRC). The report, titled “Tall Tales,” provides a rare window into the evolution of “digital transnational repression” (DTR)—a strategy where state actors reach across borders to silence dissent through high-fidelity impersonation and targeted surveillance.
The findings reveal a shift toward a “Military-Civil Fusion” system, where state-sponsored attacks are increasingly carried out by private contractors to maintain plausible deniability.
Since April 2025, researchers have tracked a wide-ranging campaign of digital impersonation targeting high-profile activists from the Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora communities.
The group, tracked as GLITTER CARP, utilizes “well-thought-out digital impersonation schemes” in phishing emails. Attackers often impersonate known individuals within the activist community or send fabricated tech company security alerts to harvest credentials. Despite the diverse targets, the operation frequently reuses the same domains and impersonated identities across multiple cases.
The second half of the report focuses on SEQUIN CARP, a distinct operator whose primary target was ICIJ journalist Scilla Alecci and other international reporters investigating topics sensitive to the Chinese government.
The dual targeting of the ICIJ—using two different actors with distinct tactics—illustrates the intensive resources being poured into monitoring investigative reporting on a global scale.
The Citizen Lab warns that the outsourcing of these represive capabilities creates a dangerous environment of impunity. By leveraging private contractors, state actors can bypass traditional oversight and accountability.
As the report notes, “The dual targeting of the ICIJ—with distinct approaches and tactics—gives insight into the Chinese government’s practice of digital transnational repression (DTR) and its shift to a Military-Civil Fusion system”.
The report further emphasizes the human cost of these operations: “The use of impersonation and social engineering undermines the trust and communication networks essential for transnational civil society activism and investigative reporting”.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
