Chinese Hackers Used Facebook to Hack Uighur Muslims Living Abroad

Facebook may be banned in China, but the company on Wednesday
said it has disrupted a network of bad actors using its platform to
target the Uyghur community and lure them into downloading
malicious software that would allow surveillance of their
devices.

“They targeted activists, journalists and dissidents
predominantly among Uyghurs from Xinjiang in China primarily living
abroad in Turkey, Kazakhstan, the United States, Syria, Australia,
Canada and other countries,” Facebook’s Head of Cyber Espionage
Investigations, Mike Dvilyanski, and Head of Security Policy,
Nathaniel Gleicher, said^[1]. “This group used
various cyber espionage tactics to identify its targets and infect
their devices with malware to enable surveillance.”

The social media giant said the “well-resourced and persistent
operation” aligned with a threat actor known as Evil Eye^[2]
(or Earth Empusa), a China-based collective known for its history
of espionage attacks against the Muslim minority in the nation at
least since August 2019 via “strategically compromised websites” by
exploiting iOS and Android devices as attack surface to gain access
to Gmail accounts.

The disclosures come days after the European Union, U.K., U.S.,
and Canada jointly announced sanctions^[3] against several senior
officials in China over human rights abuses against Uyghurs in the
Chinese province of Xinjiang.

Evil Eye is said to have resorted to a multifaceted approach to
stay under and conceal its malicious intent by posing as
journalists, students, human rights advocates, or members of the
Uyghur community to build trust with targeted victims before
drawing them into clicking on malicious links.

Besides social engineering efforts, the collective leveraged a
network of malware-infested websites, both legitimately compromised
websites and lookalike domains for popular Uyghur and Turkish news
sites, that were used as a watering hole to attract and selectively
infect iPhone users based on certain technical criteria, including
IP address, operating system, browser, country, and language
settings.

“Some of these web pages contained malicious javascript code
that resembled previously reported exploits, which installed iOS
malware known as INSOMNIA^[4]
on people’s devices once they were compromised,” the company noted.
Insomnia comes with capabilities to exfiltrate data from a variety
of iOS apps, such as contacts, location, and iMessage, as well as
third-party messaging clients from Signal, WhatsApp, Telegram,
Gmail, and Hangouts.

Separately, Evil Eye also set up lookalike third-party Android
app stores to publish trojanized Uyghur-themed applications such as
a keyboard app, prayer app, and dictionary app, which served as a
conduit to deploy two Android malware strains ActionSpy^[5]
and PluginPhantom^[6]. Further investigation
into the Android malware families linked the attack infrastructure
to two Chinese companies Beijing Best United Technology Co., Ltd.
(Best Lh) and Dalian 9Rush Technology Co., Ltd. (9Rush).

“These China-based firms are likely part of a sprawling network
of vendors, with varying degrees of operational security,” the
researchers noted.

In a series of countermeasures, the company said it blocked the
malicious domains in question from being shared on its platform,
disabled the offending accounts, and notified about 500 people who
were targeted by the adversary.

This is not the first time Facebook has outed technology firms
that operate as a front for state-sponsored hacking
activities^[7]. In December 2020, the
social network formally linked OceanLotus to an information
technology company called CyberOne Group^[8]
located in Vietnam.