In this research note, we analyze a malware campaign targeting Hong Kong democracy activists. Two new malware families are used in the campaign that we name UP007 and SLServer. Previous reports have shown overlap in the tactics, tools, and procedures used in this campaign in other operations targeting groups in Burma, Hong Kong, and the Tibetan community.

This report analyzes a campaign of targeted attacks against an NGO working on environmental issues in Southeast Asia. Our analysis reveals connections between these attacks, recent strategic web compromises against Burmese government websites, and previous campaigns targeting groups in the Tibetan community.

The June 2012 issue of Southeast Asia Cyber Watch contains news articles from Burma, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam.

Additional evidence gathered by the Citizen Lab from Burma since the publication of Behind Blue Coat has provided further confirmation that Blue Coat’s devices are presently in use in the country.

Following the release of Citizen Lab’s brief, Behind Blue Coat: Investigations of commercial filtering in Syria and Burma, Citizen Lab Director Ron Deibert spoke to Marco Werman about the research findings on BBC’s The World.

Although Blue Coat has recently acknowledged the presence of their devices in Syria, this brief contributes to previous findings of devices in the country, documents additional devices in use in Syria, and identifies Blue Coat devices actively in use in Burma.