A snippet of code on the Central Tibetan Administration website redirects CN speaking users to a Java exploit that drops an APT-related backdoor. The site itself claims the administration itself as "...the Central Tibetan Administration (CTA) of His Holiness the Dalai Lama, this is the continuation of the government of independent Tibet." The selection of page placement and the timining of the attack are both fairly extraordinary, so let's dive in.