APT actors trying to use the G20 2014 summit as a lure to compromise Tibetan nongovernmental organizations (NGOs) with Gh0st RAT. Attackers sent spear phishing email to victims, the messages, supposedly from Tibet Press, proposed to the victims the participation to a rally for Tibet The email had a Word document attached that is used by attackers to exploit the CVE-2012-0158 and drop on victims machine the Gh0St RAT. This particular magic word has been used against Tibetan groups in the past.”]
Source: http://securityaffairs.co/wordpress/30302/cyber-crime/gh0st-rat-against-tibetan-ngo.html