The first line of attack in most digital espionage that uses targeted malware is luring targets to perform some kind of action, usually opening a malicious attachment or link. The social engineering tactics used in these intrusion attempts are often highly sophisticated and show a knowledge of the activities and network of the target. This level of sophistication speaks to the effort being put into the espionage campaigns and the amount of information the adversaries already have on their targets.

The stories we collected are from individuals involved in Tibet advocacy key moments in the history of the Tibetan freedom movement. The mirroring of these major events with spikes in online attacks targeting the community reflects how closely the PRC monitors the community and the persistence of digital threats over two decades.