Did you look at the screenshot and read the translation? Appears to be a real-time tracking database of Uighurs...

In the first link? Yes, but what does the first link have to do with this attack? I see nothing that ties the two together. Am I missing something in the Google link that relates to that? The list of target services doesn’t even look similar.

“The command-and-control server can also query for a list of all 3rd party apps and request uploads of their container directories.”