Facebook Takes Action Against Hackers Based in China

Facebook detailed actions it took against a group of hackers based in China, known in the security industry as Earth Empusa or Evil Eye. Head of cyber espionage investigations Mike Dvilyanski and head of security policy Nathaniel Gleicher said in a Newsroom post Wednesday that the hackers were using their infrastructure to abuse Facebook’s platform, distribute malware and hack people’s accounts across the internet. The targets were activists, dissidents and journalists, predominantly among Uyghurs from Xinjiang in China, and primarily living abroad in countries including Australia, Canada, Kazakhstan, Syria, Turkey and the U.S. Dvilyanski and Gleicher wrote, “This activity had the hallmarks of a well-resourced and persistent operation while obfuscating who’s behind it. On our platform, this cyber espionage campaign manifested primarily in sending links to malicious websites, rather than direct sharing of the malware itself. We saw this activity slow down at various times, likely in response to our and other companies’ actions to disrupt their activity.” They also shared details on the tactics, techniques and procedures used by this group across the web: Compromising and impersonating news websites: This group set up malicious websites that used look-alike domains for popular Uyghur and Turkish news sites and compromised legitimate websites frequently visited by their targets as part of watering hole attacks. A watering hole attack is when hackers infect websites frequently visited by intended targets to compromise their devices. Some of these web pages contained malicious JavaScript code that resembled previously reported exploits, installing iOS malware known as Insomnia on people’s devices once they were compromised.Fake third party app stores: Websites set up by this group mimicked third-party Android app stores and published Uyghur-themed applications, including a dictionary app, a keyboard app and a prayer app. These apps were Trojanized—meaning that they contained malware that misled people about their true intent—with two Android malware strains: ActionSpy or PluginPhantom.Industry tracking: Dvilyanski and Gleicher said Facebook’s industry peers have been tracking parts of this activity, and its investigation confirmed that the disrupted activity disrupting today closely aligns with Earth Empusa or Evil Eye. While PoisonCarp shares some TTPs—including targeting and use of some of the same vendor-developed malware—Facebook’s on-platform analysis suggested that it is a separate cluster of activity.Outsourcing malware development: This group used several distinct Android malware families, and Chinese companies Beijing Best United Technology and Dalian 9Rush Technology were the developers behind some of the Android tooling deployed by this group. Research from cybersecurity company FireEye aided Facebook’s investigation. Those two companies are likely part of a sprawling network of vendors, with varying degrees of operational security.Selective targeting and exploit protection: This group took steps to conceal their activity and protect malicious tools by only infecting people with iOS malware when they passed certain technical checks, including IP address, operating system, browser and country and language settings.Social engineering: This group used fake accounts on Facebook to create fictitious personas posing as human rights advocates, journalists, members of the Uyghur community or students to build trust with people they targeted and trick them into clicking on malicious links. Dvilyanski and Gleicher concluded, “We shared our findings and threat indicators with industry peers so they, too, can detect and stop this activity. To disrupt this operation, we blocked malicious domains from being shared on our platform, took down the group’s accounts and notified people who we believe were targeted by this threat actor.”

Platforms

Facebook Takes Action Against Hackers Based in China

The group is known as Earth Empusa or Evil Eye

David Cohen

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

David Cohen