BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors

With support from the UK Cyber League, this advisory has been jointly produced by the National Cyber Security Centre (NCSC UK) and international partners:

• The Australian Cyber Security Centre, part of the Australian Signals Directorate
  
• The Canadian Centre for Cyber Security, part of the Communications Security Establishment
  
• The German Federal Intelligence Service
  
• The German Federal Office for the Protection of the Constitution
  
• The New Zealand National Cyber Security Centre, part of the Government Communications Security Bureau
  
• The United States Federal Bureau of Investigation
  
• The United States National Security Agency

Its purpose is to raise awareness about the growing threat that malicious cyber actors pose to individuals connected to topics including Taiwan, Tibet, Xinjiang Uyghur Autonomous Region, democracy movements and the Falun Gong. 

This advisory includes two case studies detailing techniques used by malicious cyber actors using spyware known as BADBAZAAR and MOONSHINE to target data on mobile devices including smartphones that could be of interest to the Chinese state. It also signposts to guidance to help individuals protect themselves, their devices and their data.

Alongside this advisory, the NCSC has published full technical detail with separate guidance.

View full advisory