Facebook Bans Pakistani and Syrian Hacker Groups for Abusing its Platform

Meta, the company formerly known as Facebook, announced^[1]
Tuesday that it took action against four separate malicious cyber
groups from Pakistan and Syria who were found targeting people in
Afghanistan, as well as journalists, humanitarian organizations,
and anti-regime military forces in the West Asian country.

The Pakistani threat actor, dubbed SideCopy^[2], is said to have used
the platform to single out people with ties to the Afghan
government, military and law enforcement in Kabul.

The campaign, which Meta dubbed as a “well-resourced and
persistent operation,” involved sending malicious links, often
shortened using URL shortener services, to websites hosting malware
between April and August of 2021, what with the operators posing as
young women and tricking the recipients with romantic lures in a
bid to make them click on phishing links or download trojanized
chat applications.

Meta’s threat intelligence analysts said these apps were a front
for two distinct malware strains, a remote access trojan named
PJobRAT^[3], which was previously
found targeting the Indian military forces, and a previously
undocumented implant dubbed Mayhem that’s capable of retrieving
contact lists, text messages, call logs, location information,
media files, device metadata, and even scrape content on the
device’s screen by abusing accessibility services^[4].

Among other SideCopy’s tactics, the hacker group engaged in a
number of nefarious activities, including operating rogue app
stores, compromising legitimate websites to host malicious phishing
pages that were designed to manipulate people into giving up their
Facebook credentials. The group was purged from Facebook in
August.

Furthermore, Meta also said it disrupted three hacking networks
linked to the Syrian government and specifically Syria’s Air Force
Intelligence —

• Syrian Electronic Army aka APT-C-27^[5], which targeted
  humanitarian organizations, journalists and activists in Southern
  Syria, critics of the government, and individuals associated with
  the anti-regime Free Syrian Army with phishing links to deliver a
  mix of commercially available and custom malware such as njRAT^[6]
  and HmzaRat^[7]
  that are engineered to harvest sensitive user information.

• APT-C-37^[8], which targeted people
  linked to the Free Syrian Army and military personnel affiliated
  with opposition forces with a commodity backdoor known as SandroRAT^[9]
  and an in-house developed malware family called SSLove via social
  engineering schemes that duped victims into visiting websites
  masquerading as Telegram, Facebook, YouTube, and WhatsApp as well
  as content focussed on Islam.

• A government-linked unnamed hacking group that
  targeted minority groups, activists, opposition in Southern Syria,
  Kurdish journalists, and members of the People’s Protection Units
  and Syria Civil Defense, with the operation manifesting in the form
  of social engineering attacks that entailed sharing links to
  websites hosting malware-laced apps mimicking WhatsApp and YouTube
  that installed SpyNote and Spymax remote administration tools on
  the devices.

“To disrupt these malicious groups, we disabled their accounts,
blocked their domains from being posted on our platform, shared
information with our industry peers, security researchers and law
enforcement, and alerted the people who we believe were targeted by
these hackers,” the social technology firm’s Mike Dvilyanski, head
of cyber espionage investigations, and David Agranovich, director
of threat disruption, said.