Loading threat actor…
TA413 is a China-aligned espionage threat actor focused primarily on the Tibetan community, including Tibetan organizations, dissidents, and the broader Tibetan diaspora. The group has also targeted officials and organizations in Europe and the United States, and at times broader diplomatic, legislative, policy, and economic entities, but its most consistent long-term victimology centers on communities viewed as sensitive to Chinese state interests. TA413 is widely associated with surveillance and intelligence collection rather than financially motivated crime. The actor has conducted sustained spearphishing campaigns using socially engineered lures themed around Tibetan affairs, public health, and current events. Observed delivery methods include malicious Office documents, Royal Road weaponized RTF files, PPSX attachments, phishing links, and fake software-update pages. TA413 has exploited CVE-2022-30190 (Follina) in campaigns against the Tibetan diaspora and has used Equation Editor exploits in earlier operations. The group has also used browser-based and mobile-focused intrusion methods, including delivery of a malicious Firefox extension and use of ScanBox for reconnaissance and keylogging. Malware and tooling associated with TA413 include ExileRAT, Sepulcher, FriarFox, ScanBox, and activity overlaps reported around BADBAZAAR. Sepulcher is a remote access trojan used for host reconnaissance, file operations, reverse shell access, and persistence. FriarFox is a trojanized Firefox extension derived from an open-source Gmail notifier that enables access to browser and Gmail data and can facilitate follow-on collection. ScanBox has been used for browser reconnaissance and keylogging. TA413 has also been linked in reporting to historical LuckyCat-related activity and to infrastructure patterns seen in Tibetan-targeting campaigns. The group’s tradecraft emphasizes credential and data collection, surveillance of civil society, and long-term access to victim environments. Reported capabilities include phishing-based initial access, reconnaissance, keylogging, exfiltration, persistence, and defense evasion through socially tailored delivery and deceptive application or update themes. TA413 has repeatedly impersonated Tibetan organizations and other trusted entities to increase lure credibility. The actor is assessed as aligned with Chinese state interests and as supporting espionage and monitoring of dissident and exile communities.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
17 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Historically reported targeting of Tibetan organisations; referenced here due to overlaps in domain registration patterns and spoofing of Tibetan-themed infrastructure.
Named as one of several China-based threat actors observed using the ScanBox framework.
Exploited the Follina (CVE-2022-30190) MSDT RCE zero-day in phishing/lure-based attacks targeting the Tibetan diaspora.
Actively exploiting the Follina vulnerability in phishing campaigns, with ongoing hacking operations against the Tibetan community and victims including officials in Europe and the United States.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.