to the IP address 119.84.4.43, which is assigned to China Telecom in the province of Chongqing, PRC. The commands sent by the command and control server were identical to malware we found at the Tibetan NGO Drewla