HenBox is a China-linked cyber espionage group targeting Uighur individuals and Xiaomi devices.
HenBox is a nation-state threat actor linked to China, primarily targeting Uighur individuals. The group focuses on espionage against this ethnic minority and devices from the Chinese mobile phone manufacturer Xiaomi. While specific TTPs and tools are not detailed in the provided information, the actor's known focus is cyber espionage. Defenders should pay attention to targeted phishing campaigns aimed at the Uighur community, as well as malicious applications or vulnerabilities on compromised Xiaomi devices.
This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile phone manufacturer Xiaomi, for espionage purposes.
HenBox primarily targets Uighur individuals.
HenBox targets Xiaomi mobile devices.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.