Facebook takes action against hackers in Bangladesh, Vietnam

Facebook has taken action against two separate groups of hackers -- an unnamed group based in Bangladesh and APT32 in Vietnam, the social media giant said in a statement.

The authorities removed the hackers’ ability to use their infrastructure to abuse the platform, distribute malware and hack people’s accounts across the internet.

The operation from Bangladesh focused on compromising accounts across platforms and coordinating reporting to get targeted accounts and pages removed from Facebook, whereas the operation from Vietnam focused primarily on spreading malware to its targets.

The Bangladesh-based group targeted local activists, journalists and religious minorities, including those living abroad, to compromise their accounts and have some of them disabled by Facebook for violating its “community standards”.

Facebook’s investigation linked this activity to two non-profit organisations in Bangladesh: Don’s Team, also known as Defence of Nation, and the Crime Research and Analysis Foundation or CRAF. They appeared to be operating across a number of internet services.

Don’s Team and CRAF collaborated to report people on Facebook for fictitious violations of the social media network’s community standards, including alleged impersonation, intellectual-property infringements, nudity and terrorism, according to the statement.

They also hacked people’s accounts and pages, and used some of these compromised accounts for their own operational purposes, including to amplify their content. “On at least one occasion, after a page admin’s account was compromised, they removed the remaining admins to take over and disable the page,” Facebook said.

“The investigation suggests that these targeted hacking attempts were likely carried out through a number of off-platform tactics including email and device compromise and abuse of our account recovery process.”

To disrupt this activity,  Facebook removed the accounts and pages behind this operation. They encourage people to remain vigilant and take steps to protect their accounts, Facebook said.

People should avoid clicking on suspicious links and downloading software from untrusted sources that can compromise their devices and information stored on them.

APT32, an advanced persistent threat actor based in Vietnam, targeted Vietnamese human rights activists locally and abroad, various foreign governments including those in Laos and Cambodia, non-governmental organisations, news agencies and a number of businesses across information technology, hospitality, agriculture and commodities, hospitals, retail, the auto industry, and mobile services with malware.

APT32 created fictitious personas across the internet posing as activists and business entities, or used romantic lures when contacting people they targeted.

These efforts often involved creating backstops for these fake personas and fake organisations on other internet services so they appear more legitimate and can withstand scrutiny, including by security researchers. Some of their Pages were designed to lure particular followers for later phishing and malware targeting.

In addition to using pages, APT32 lured targets to download Android applications through Google Play Store that had a wide range of permissions to allow broad surveillance of peoples’ devices.

It also compromised websites and created their own to include obfuscated malicious javascript as part of their watering hole attack to track targets’ browser information.