Cybersecurity researchers from Facebook today formally linked the activities of a Vietnamese threat actor to an IT company in the country after the group was caught abusing its platform to hack into people\u2019s accounts and distribute malware.<\/p>\n
Tracked as APT32 (or Bismuth, OceanLotus, and Cobalt Kitty), the state-aligned operatives affiliated with the Vietnam government have been known for orchestrating sophisticated espionage campaigns at least since 2012 aligned with the goal of furthering the country\u2019s strategic interests.<\/p>\n
\u201cOur investigation linked this activity to CyberOne Group, an IT company in Vietnam (also known as CyberOne Security, CyberOne Technologies, H\u00e0nh Tinh Company Limited, Planet and Diacauso),\u201d Facebook\u2019s Head of Security Policy, Nathaniel Gleicher, and Cyber Threat Intelligence Manager, Mike Dvilyanski, said.<\/p>\n
Exact evidence trail leading Facebook to attribute the hacking activity to CyberOne Group was not disclosed, but according to a description on ITViec \u2014 a Vietnamese online platform to find and post job vacancies for IT professionals and software developers \u2014 the company advertises itself as a \u201cmultinational company\u201d with a focus on developing \u201cproducts and services to ensure the security of IT systems of organizations and businesses.\u201d<\/p>\n
As Reuters reported earlier, its website appears to have been taken offline. However, a snapshot captured by the Internet Archive on December 9 shows that the company had been actively looking to hire penetration testers, cyber threat hunters, and malware analysts with proficiency in Linux, C, C++, and .NET.<\/p>\n
CyberOne, in a statement given to Reuters, also denied it was the OceanLotus group.<\/p>\n
APT32\u2019s Long History of Attacks
\nFacebook\u2019s unmasking of APT32 comes months after Volexity disclosed multiple attack campaigns launched via multiple fake websites and Facebook pages to profile users, redirect visitors to phishing pages, and distribute malware payloads for Windows and macOS.<\/p>\n
Additionally, ESET reported a similar operation spreading via the social media platform in December 2019, using posts and direct messages containing links to a malicious archive hosted on Dropbox.<\/p>\n
The group is known for its evolving toolsets and decoys and its use of decoy documents and watering-hole attacks to entice potential victims into executing a fully-featured backdoor capable of stealing sensitive information.<\/p>\n
The group is known for its evolving toolsets and decoys, including in its use of lure documents and watering-hole attacks to entice potential victims into executing a fully-featured backdoor capable of stealing sensitive information.<\/p>\n
OceanLotus gained notoriety early last year for its aggressive targeting of multinational automotive companies in a bid to support the country\u2019s vehicle manufacturing goals.<\/p>\n
During the height of the COVID-19 pandemic, APT32 carried out intrusion campaigns against Chinese targets, including the Ministry of Emergency Management, with an intent to collect intelligence on the COVID-19 crisis.<\/p>\n
Last month, Trend Micro researchers uncovered a new campaign leveraging a new macOS backdoor that enables the attackers to snoop on and steals confidential information and sensitive business documents from infected machines.<\/p>\n
Then two weeks ago, Microsoft detailed a tactic of OceanLotus that involved using coin miner techniques to stay under the radar and establish persistence on victim systems, thus making it harder to distinguish between financially-motivated crime from intelligence-gathering operations.<\/p>\n
Social Engineering via Facebook
\nNow according to Facebook, APT32 created fictitious personas, posing as activists and business entities, and used romantic lures to reach out to their targets, ultimately tricking them into downloading rogues Android apps through Google Play Store that came with a wide range of permissions to allow broad surveillance of peoples\u2019 devices.<\/p>\n
\u201cThe latest activity we investigated and disrupted has the hallmarks of a well-resourced and persistent operation focusing on many targets at once, while obfuscating their origin,\u201d the researchers said. \u201cTo disrupt this operation, we blocked associated domains from being posted on our platform, removed the group\u2019s accounts and notified people who we believe were targeted by APT32.\u201d<\/p>\n
In a separate development, Facebook said it also disrupted a Bangladesh-based group that targeted local activists, journalists, and religious minorities, to compromise their accounts and amplify their content.<\/p>\n
\u201cOur investigation linked this activity to two non-profit organizations in Bangladesh: Don\u2019s Team (also known as Defense of Nation) and the Crime Research and Analysis Foundation (CRAF). They appeared to be operating across a number of internet services.\u201d<\/p>\n
Source: The Hacker News<\/em><\/p>","protected":false},"excerpt":{"rendered":" Cybersecurity researchers from Facebook today formally linked the activities of a Vietnamese threat actor to an IT company in the country after the group was caught abusing its platform to hack into people\u2019s accounts and distribute malware. Tracked as APT32 (or Bismuth, OceanLotus, and Cobalt Kitty), the state-aligned operatives affiliated with the Vietnam government have […]<\/p>","protected":false},"author":2,"featured_media":6479,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-1314","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-social-networks"],"_links":{"self":[{"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/posts\/1314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/comments?post=1314"}],"version-history":[{"count":4,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/posts\/1314\/revisions"}],"predecessor-version":[{"id":6496,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/posts\/1314\/revisions\/6496"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/media\/6479"}],"wp:attachment":[{"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/media?parent=1314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/categories?post=1314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/woas.academy\/pt\/wp-json\/wp\/v2\/tags?post=1314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}