Facebook’s threat intelligence unit claims to have disrupted a sophisticated Chinese spying operation that targets journalists, protesters, and activists all over the world with iPhone and Android malware.
The hacking community, dubbed Evil Eye by malware researchers, has used Facebook to spread links to websites that are rigged with exploits for the two major mobile platforms.
Mike Dvilyanski, Facebook’s Head of Cyber Espionage Investigations, has released an advisory with indications of vulnerability (IOCs) and other information to assist victims and targets in thwarting the attacks.
According to Dvilyanski, the Evil Eye gang has mostly targeted Uyghurs from Xinjiang and those living abroad in Turkey, Kazakhstan, the United States, Syria, Australia, Canada, and other nations.
He warned that the Evil Eye gang is “a well-resourced and persistent organisation,” adding, “This group used various cyber espionage techniques to identify its targets and infect their computers with malware to allow surveillance.”
Facebook revealed the group’s TTPs (tactics, strategies, and procedures), which included accurate, targeted victim targeting. “This group took measures to hide their activities and secure malicious tools by infecting people with iOS malware only after they passed certain technical tests, such as IP address, operating system, browser, and country and language settings,” he explained.
Facebook also revealed that fake accounts were used to construct fictional personas posing as journalists, students, human rights activists, or members of the Uyghur community in order to gain confidence and trick people into clicking on malicious links.
The group has also been seen using phoney third-party app stores and outsourcing Android malware production to two Chinese firms. “These Chinese companies are most likely part of a large network of vendors with varying levels of operational security,” Dvilyanski said.
Facebook has published hashes and domains associated with this threat actor.