How ExileRAT serves the Tibetan leadership’s purpose

Tibetan President Lobsang Sangay (left) and Dhardon Sharling (right), the CTA’s former propaganda officer and a protégé of Lobsang Sangay. Sharling suddenly resigned from her position as Secretary of the CTA’s Department of Information and International Relations. During her tenure, she was responsible for the CTA’s disinformation campaigns and would have had complete access to the Tibetan leadership’s mailing list. It is this very same list that was recently targeted with an email and attachment that, when downloaded and opened, installed malicious malware onto the downloader’s computer.




By: Shashi Kei

The Central Tibetan Administration (CTA), which is the Tibetan government-in-exile based in Dharamsala, recently came under a cyber-attack. Those on the CTA’s mailing list received emails supposedly from the CTA, containing a PowerPoint file titled “Tibet Was Never A Part Of China”. The file, it turns out, was a payload that delivered what is known as ‘ExileRAT’, a Remote Access Trojan (RAT) which, once activated, allows the attacker(s) to access private information stored in the victims’ computers.

The spam email that those on the CTA’s mailing list received. Attached was a PowerPoint file that, when downloaded and opened, launched a rudimentary Trojan designed to steal the downloader’s personal information.

CTA supporters, pro-Tibetan groups and American companies were quick to accuse China of being behind this attack. In recent years, it has become common for the CTA and its allies like the United States (US) to accuse China of launching cyber-espionage campaigns to steal government and trade secrets from Western countries. This has been a part of the anti-China propaganda aimed at curbing China’s rise as a global superpower that threatens to displace the US. This narrative suits the CTA as it fits into their portrayal as a victim of China’s evil designs and also lends to the CTA’s campaign of spreading fear and enmity towards China.

However, this ExileRAT case in fact showcases the CTA’s tendency for agitprop and its failings as a government more so than it does China’s alleged espionage activities. To begin with, the fact China, Russia, Israel, the US and its NATO allies, and other nation-states should engage in one form of espionage or another is not surprising. It would be naïve to think that powerful nations vying for supremacy on the world stage do not play the spy game or engage in propaganda warfare in attempts to tilt the balance of global hegemony in their favor. It was not so long ago when the US vehemently accused Iraq of harboring terrorists and developing weapons of mass destructions and, on that justification alone, invaded Iraq, overthrew the government and assassinated its leader. Later, it was revealed that the US invasion of Iraq was not based on facts but disinformation.

The CTA’s PowerPoint file that contained the malware. This file was created as part of the CTA’s propaganda against China. Oddly, the file that contained the malware is an exact copy of the CTA’s own publication, leading some analysts to suspect that the CTA may be behind the attack on its own database.

Whilst the technical jargon in the ExileRAT news report may perplex some readers, there are a number of clues that reveal that ExileRAT was not the work of the Chinese government. Nevertheless, it provided the CTA with yet another excuse to attack China with. Ironically the way ExileRAT was executed has led observers to suspect that the CTA itself is behind this charade:

  1. The design of the supposed ExileRAT was so basic and amateurish that even the basic Norton Antivirus is capable of stopping it. The CTA and the West consistently decry China’s technical capabilities, for example in their implementation of the so-called Great Firewall of China. It is therefore illogical for the CTA to also blame ExileRAT on China when, considering their own recognition of China’s technical capabilities, the CTA knows China would be capable of executing something far more sophisticated if they wanted to.

A regular Norton Antivirus scan is capable of stopping the intrusion attempt. The attacker’s URL and IP address is also clearly listed and not masked.

  1. In addition, those who are more technically savvy have pointed out that the hacker carelessly omitted to block the server’s directory listing (see at your own risk), which is a significant hint that this is not the work of professionals. For certain it would not be the work of a ‘state actor’ as reported, which in essence, points the finger at China.
  2. The IP is not unique and cannot be definitively ascribed to China, whom the CTA have been so quick to accuse. The IP of the hacker is recognized to be the same that has been named in various hackers and spammers’ arenas, for having made several random amateur attacks on websites.

Researcher’s report identifying the attacker’s IP which is known in hackers’ circles and is commonly associated with previous attacks that are not known to originate from China. Also, unlike SC Media’s report which stated the Trojan executables were intended to harm via their Windows and Android devices, in reality the Trojan executables found at the IP address associated with the attack was not an Android version. It was a simple Windows-based Trojan (.exe file), not running on Android at all.

  1. An alarmist report by SC Media claimed, “An analysis of the campaign revealed ExileRAT shares a command-and-control infrastructure with LuckyCat, an older RAT attributed to a suspected Chinese APT group that goes by the same name. Historically, the LuckyCat Trojan has been used to spy on pro-Tibetan activists and sympathizers via their Android and Windows devices.” Again, this is intended to incriminate China. However, this is an overt distortion of the truth to blindside readers. An IT specialist consulted to verify the accuracy of this claim instead certified that the Trojan executables found at the IP address associated with the attack was not an Android version, as SC Media claimed, but was a simple Windows-based Trojan, and not running on Android at all.

Clearly the objective of the ExileRAT reports was not to relay facts but to sow distrust, fear and enmity towards China. The obvious question is to whose benefit is this campaign of disinformation? China appears to be a scapegoat but it is not difficult to see the incongruity of this accusation.

On the one hand China is reported to have the highest level of technical sophistication that logically extends to spyware as well. Chinese telecommunications brands Huawei and ZTE have also been accused of allowing their products to be used to spy for the Chinese government. Yet, if it is true that China seeks to infiltrate the CTA’s database, why would a global titan and a technology powerhouse like China engage the services of an amateur hacker who leaves so many residuary trails and whose malware could be halted by mere commercial-grade antivirus? China regards the Dalai Lama and CTA as extremely dangerous secessionists and would surely not entrust its alleged espionage of them to what appears to be a hobbyist hacker. So this accusation does not make sense. What does make sense however, is how this spread of news facilitated yet another attack to discredit China. It also conveniently coincides with the US’s full frontal assault on Chinese technology-based corporations in an effort to curb their creeping dominance.

On the other hand, the ExileRAT bungling is more characteristic of the CTA who has been caught red-handed on several occasions for failed covert online operations. Some examples include:

  1. The sponsorship and establishment of anti-religion websites. In 1996, the CTA unlawfully and unconstitutionally banned the 350-year-old practice of Dorje Shugden. To support its assault on Shugden Buddhists, the Tibetan leadership launched what they intended to be an anonymous site to spread disinformation and a twisted history of Dorje Shugden. The site was named ‘‘ and contrived to be an independent site run by academics and Buddhist scholars. However, a simple WHOIS search revealed that this supposedly anonymous and defamatory site was owned by Gangchen Kyishong, the name being synonymous with the location of the CTA’s headquarters in Dharamsala.

Dr Lobsang Sangay who, in 2012 in his capacity as the Prime Minister of the Tibetan people, launched a book that deifies Tibetan self-immolators and provides potential self-immolators with a guide to carry out their act.

  1. Such oversight is common of CTA officials whose nefarious plans are often not matched by the required dexterity or mental agility to pull off the stunt. Another example of a CTA blunder is their publication of a self-immolation guide, teaching Tibetans how to maximize exposure of their suicide by self-immolation, to incriminate China. This coincided with the CTA’s launching of a book that glorified Tibetans killing themselves, primarily because grisly spectacles of Tibetans being burnt to death have the power to sway sentiments against China, precisely as the CTA intends. Hence, the CTA in fact encourages Tibetan self-immolation and have not taken effective measures to discourage it. In reality, the opposite is true and they even teach people how to do it. After coming under heavy criticism, the website of the CTA representative was subsequently deleted but cached pages of its contents remain. This entire sorry episode was observed and recorded by investigative journalists, one of whom wrote:




The CTA’s man in America Robert Thurman attempted to solicit the services of the Anonymous hackers group, to intimidate and harass Dorje Shugden practitioners. Thurman’s actions show a clear disregard for American laws which make it illegal to solicit hacking, as well as a clear disregard for the American Constitution which allows for freedom of religion. Realizing the mistake of seeking hackers openly, Thurman subsequently deleted all posts that incriminate him.

  1. Then there is the infamous “Lama Gate” scandal wherein the Tibetan leadership’s man in the US, Robert Thurman, foolishly solicited the services of online hackers to steal personal information and details of Dorje Shugden practitioners. Not only is it illegal to solicit hacking, but it is also immoral for the CTA and its supporters to intimidate and criminalize anyone just because of their religion. This episode shows that the CTA are fully aware of the existence of such services, and are not beyond using clandestine, underhanded means to attack those they consider their rivals. It would be well within their capabilities and interests to attempt to harness ExileRAT to attack their own people, in order to vilify China and rally support for themselves. This abuse of privacy and criminal intimidation is nothing new to the CTA who has also published a ‘hit list’ of people who have protested against the Dalai Lama’s illegal religious ban. The purpose of the CTA publishing this hit list is of course an unspoken instruction for supporters of the Tibetan leadership to seek out and punish anyone who dares question the CTA. That Western media should vigorously publish scaremongering articles blaming China for the ExileRAT cyber-espionage, but remained completely mute when the pro-Tibetan Robert Thurman was caught attempting to do the same, speaks volumes of who is pulling the strings. Both the ExileRAT and Robert Thurman‘s “Lama Gate” scandal have the same objective – to illegally hack into private databases and steal information of private individuals and use the information with criminal intent.
  2. The CTA was also discovered to have engaged the services of an East German-trained operative masquerading as a monk by the name of Tenzin Peljor. On the CTA’s webpage that was set up exclusively to incite hatred against Dorje Shugden Buddhists, Tenzin Peljor is named as a media contact. Peljor recently gained notoriety after he was sued by a large European-based Buddhist organization for posting defamatory material on his controversial blog aimed at defaming and attacking those not in the Tibetan leadership’s favor. In addition, this CTA agent is well known to act on the CTA’s behalf to recruit an army of Internet trolls, each with multiple anonymous social media accounts which they use to attack China and anyone whom the CTA targets. He has also been seen at European talks given by the Dalai Lama, photographing people protesting against the Tibetan leadership’s illegal discrimination of Dorje Shugden practice. Those photographs later ended up on the CTA’s aforementioned hit list of Shugden worshippers, which was widely circulated online and throughout the Tibetan settlements.

East-German-trained operative Michael Jäckel a.k.a Mick Jackman a.k.a. Tenzin Peljor is the CTA’s propaganda consultant and assumes a number of pseudonyms that he uses to launch smear campaigns on behalf of the CTA.

The cases cited above are but some samples of the CTA’s cyber-crimes. Whether the US or China engages in cyber-espionage is speculation but what is confirmed is that the CTA does and they have acted as if they are above the law. 60 years in exile and acting as a ‘government’ that does not fall within the ambit of any international legal system means that the Tibetan leadership has acted without any accountability. The ExileRAT episode not only exposes the CTA’s online malfeasance but also the apathetic attitude it has taken towards the people who have supported its cause. Solely for the satisfaction of vilifying China, they voluntarily exposed their mailing list to hackers, which in turn put all of those recipients’ private and personal information at risk. Apart from this recent case, the Dalai Lama and the CTA’s websites have constantly infected visitors with viruses. Again the blame is pinned on China and this reveals the mentality of those who run the CTA, that it is easier to blame China than to take responsibility to protect its supporters.

Some observers have also speculated that Dhardon Sharling’s sudden resignation may be related to this scandal. As the former Secretary of the CTA’s Department of Information and International Relations, Sharling was responsible for the CTA’s campaigns of disinformation during her tenure. Together with the CTA President Lobsang Sangay, with whom she is strongly rumored to have had a sexual relationship, they launched campaign after propaganda campaign against anyone whom they deemed to be disloyal or disobedient of the CTA’s policies. In her position, Sharling would have had complete access to the Tibetan leadership’s mailing list, the very same one which was targeted in this email attack.

Did she accidentally expose the mailing list, thereby failing to discharge her duties in protecting the CTA’s supporters’ private information? Or worse still, did she intentionally expose the mailing list and orchestrate this attack against the CTA’s supporters, all so she could blame China? Either scenario does not put the CTA in a good light. The failure of the Tibetan leadership to secure its own database of supporters should not come as a surprise. If the Tibetan leadership is proven not to have any care for Tibetans who followed the Dalai Lama into exile and are now languishing within sight of the CTA, why would the same corrupt officials care about names in a database apart from regarding them as people to extract money from and minds to exploit for its own political gain?


[Bleeping Computer] ExileRat Targeting Tibetan
Supporters via Malicious PowerPoint Docs

Cropped for brevity. Click to enlarge and read the full post (Source:


[Threat Post] Spy Campaign Spams
Pro-Tibet Group With ExileRAT



[Talos Intelligence] ExileRAT shares C2 with
LuckyCat, targets Tibet



[Cyberscoop] How hackers used a PowerPoint file
to spy on Tibet’s government-in-exile



[ZDNet] Pro-Tibet groups targeted
with ExileRAT in spy campaign



[SC Media] Phishing campaign targeted subscribers
to Tibetan Government-in-Exile’s mailing list


Please support this website by making a donation.
Your contribution goes towards supporting
our work to spread Dorje Shugden across the world.
Share this article
20 total comments on this postSubmit yours
  1. This is another incident can be used to accuse China! That must be what the CTA is thinking…

    The price is high when you support a “government” like CTA, whom is not governed by any international laws and without ethics and responsibilities at all— you might risk to lose your privacy and infected your phones and computers with the virus and steal your personal information! Tibetan leadership does not care about this at all! They only care about their pocket. Sad.

  2. I am not surprised that Sikyong Lobsang Sangay is behind this. I remember when he launched the Tibetan self immolation book. That year was the most Tibetan suicides and the Sikyong used Tibetan deaths as excuse to promote himself.

    Like many Tibetan, I prefer if the Tibetan people are together and still have our country but at the same time I am glad we are not stuck under Sikyong Lobsang Sangay. These few years he really show his color and how ruthless he can be.

    This attack on the CTA mailing list is shameful. Why is it the CTA cannot upgrade their antivirus? Even small companies and young students know how to do that unless as this article says, the attack is done on purpose to give Sikyong Lobsang Sangay something more to promote himself.

    I also find the big difference in facts as reported in western news and the facts in this article, quit shocking. I think most people do not understand this kind of technical stuff but even my young one can explain what this article was saying. Basically its all CTA lies again.

  3. Karmapa Thaye Dorje Ignores the Dalai Lama











    Karma Tsogyal


  4. The CTA is always there to accuse people of being spies, paid to do harm, yet they themselves always play the victim card…😤 Here again the CTA is accusing China with this malware, which was send to all their supporters. But would China be so unprofessional to have the malware detected and blocked by a simple antivirus program?

    Anyway the timely coincidence between the resignation of Dhardon Sharling and this malware send to the CTA supporters is quite alarming. So, many will suspect Dhardon Sharling behind this…

    Or is someone trying to get her through this email…??

  5. It is disgusting to read of what CTA is doing to put blame on China. It is known that CTA being an entity which is not governed by any international laws nor courts of justice has the freedom to do whatever it likes.

    Having the absolute right to do whatever, CTA deems fit without consideration of consequences. It is the hope and wish of many people that CTA should learn to operate with better grace and smartness. Not be so clumsy.

    Being the Public relations and legal arm of the Dalai Lama, it is a surprise that even human dignity and compassion is not forth coming from members of the CTA.

    CTA is a joke and with sincerity, please let the Tibetans wise up and no more execute the instructions of CTA to do further harm and disparage the office of the Dalai Lama.

    Most of all no more self immolation that is encouraged and praised by CTA as suicide is a heinous act against the tenets of Buddhism.

  6. How much deeds the CTA had done, that’s how much karma the CTA had to receive. CTA was always quick in blame and accuse China as being anti-DL, pro DS whenever they are screwed up. This is real example of fail leaderships. Now, true fact reviewed that their people were in the play. Who to be blame? If accusing Dhardon Sharling behind this, which means CTA not only incapable in hiring profession and also taking her as scapegoat to cover this issue. Is a wonder how much longer CTA need to cover up their wrong?

  7. Hmmm…I smell a RAT. Actually two RATS. One male, the other female. Both living in EXILE. EXILERATS. What a great pair. Lol! 😆🐀🐁

  8. Instead of pointing fingers, please get proof. Poor leadership and low eq cause much embarrassment. But it’s always fun to see how Cta humiliate themselves instead of actually sitting down and find a solution like actual ‘politicians’. I bet their first thought was thinking how not to solve it coz it’s too much work so just point the finger at the enemy. Less hassle.
    The same as Dorje Shugden ban, just say it’s wrong, it’s harmful, it’s no good and make everyone follow it. No proof no logic. And people just follow blindly without second thoughts. In this age and time, I thought people would be wiser coz everything can be searched online, compared and learn with logic.

  9. The CTA should be ashame fo themselves. Everytime when something happens they will point the fingers to others and they will act like they are the poor victim. For goodness sake, can the CTA something good for once. Don’t they feel tired. The karma of CTA is running low and they will feel the pain very soon.

  10. What is new with CTA. Another set of blunders reinforcing their own downfall. Yes these are rats!

  11. The CTA thought everybody in world has a simple mind like them, or maybe simple mind like Lobsang Sangay. Simply pointing finger at China and accused them for hacking their database? Oh my god….. this is the most ridiculous joke! China won’t be so free to do this minor thing to CTA. In the world, in the United Nation, who is CTA? Does CTA even exist? Come on CTA, I know u’re hungry of being the limelight and the center of attention of the world, but can you do something more constructive, rather than doing all these petty petty things? Simply appoint a cheap skate hacker and hack back your own database, then simply point it to China. Lobsang Sangay, if one day a Tibetan cat can’t catch a rat, will you say that cat is a China spy? 😂🙏😅😂🙏😅😜😂

  12. Well, CTA need to keep create issue to get attention from the world, otherwise the world will forget them. The best is always issue that related to China and accuse China. This kind of action is just like to strike a stone with egg. CTA,please spend your time to bring benefit to the Tibetan in exile.

  13. It’s sick to keep on seeing & hearing the CTA non-stop creating problem to NOT ONLY LIMITED to their own society but to other countries too.

    Such leaders will never bring hope to their people & is going to make things worst.

    Taut Rope Breaking Apart

  14. Whenever CTA make the false accusation to China , they had fall badly by their own trap. They need someone to sacrify and to be blame. How long will CTA keep going. Is funny people notice this smell the real rat is actually is CTA. Let see what games they have and how long the games will last.

  15. For CTA keep attacking China how would this serve Dalai Lama’s wishes to go back to China? How would this attack serve CTA promises to bring back the Tibetans back to their homeland Tibet?

    Aren’t CTA realize that they don’t have anything to negotiate but at very least not to irk the Chinese and in fact should be friended with them to pave their way back.

    It’s amazing to see how CTA leadership create so much suffering to their own people by segregating and discriminating the differences of spiritual practice such as Dorje Shugden, encouraging their own Tibetan to scarifies themselves, involve in cybercrime, scandals and so many more. All these act doesn’t even help in a single bit to relief the Tibetan 60 years of suffering being in exile. How could a leader treat their own people like that and how could CTA justify to the world for the people that have supported and donated so much for them? Where are those moneys go to to show that they have manage the fun well and uplifting the Tibetan welfare? On the other hand, now a day we keep hearing so many disturbing news about CTA. The world are watching and CTA can’t fool anyone anymore! They must get their act together and protect their own people and do fully and sincerely do something to benefit the Tibetans.

  16. If i am a Tibetan, I will be extremely shameful for this bunch of CTA exilesRAT. They are nobody but rats.. hiding, doing things behind others, rootless, illogical, cruel, heartless, selfish.. to the Tibetan who sacrificed their lives with motivation for saving their country, i solute. but the problem is, your lives worth nothing to these bunch of RATS but to being used for self interest purposes. There’ no different of spreading poisons to the Tibetan and plan for their death so that CTA can enjoy their lives more.

  17. Again blame to China.. as it is China have nothing better to do…

    CTA is really harmful not only to own refugees, look at how they “bully” their own refugees in India and brainwash them and now they are still remain as poor refugees, while CTA gain their wealth.

    IF anyone still support CTA and can’t see this clearly. They are helping the CTA to bully more

  18. Contemplate this :-











  19. 1st Time Dalai Lama Finally Admits His Illness Was Serious




    PM Modi snubs Tibetan leadership for swearing-in ceremony
    By Tenzin Dharpo
    May. 30, 2019

Submit your comment

Please enter your name

Please enter a valid email address

Please enter your message

Show More
Show More


Maximum size is 64MB

Contemplate This



© 2019 | All Rights Reserved
Total views:7,942,542