Meta detected a hacking group 

According to the reports released on Wednesday, Meta detected a hacking group linked to Pakistan targeting Indian Army personnel. This group had 120 accounts on Instagram and Facebook.

 Meta’s Investigation

The Meta’s investigation connected it to state-linked actors in Pakistan. The Cyber Security team took action against this hacking group operating out of India that targeted people in Bangladesh,  Sri Lanka, Pakistan, India, the Tibet region, and China, including military personnel, activists, and minority groups.

This group targeting Indian Army personnel is named APT. The Cyber Security team of Meta detected this group operated through a spear phishing campaign.

This campaign is involved sending emails to military personnel with malicious attachments or links. On clicking the link, it would install malware on their devices and allow the hackers to access sensitive military information, including confidential data related to Indian defence operations.

This group also posed as recruiters, journalists, fake defence companies and the government to gain the trust of the targeted people.

What is APT?

APT is an Advanced Persistent Threat that steals sensitive data through websites and malware. Its presence remains undetected for a long time. Hackers use several tools and work hard to stay hidden.

Nathaniel Gleicher, Meta’s Vice President of Global Security, mentioned that their company is committed towards the security of its users and will work closely with enforcement and intelligence agencies to identify and disrupt malicious activity on its platform.

There are no comments on this issue by the Indian Government till now. In the past also, the country’s military has been targeted several times. A similar spear-phishing campaign by Chinese hackers targeted Indian military personnel in 2019. Power plants, telecommunication networks and infrastructure were targeted, in some cases.

Cyber attack has been very common and have increased with social media platforms. There has always been aggression between India and Pakistan, and with this APT hacking group discovered, the tension is said to be increasing between the two countries.

The Government and Cyber security team needs to work together to create and develop effective and necessary measures to protect the country from these thefts.

What is Phishing?

Phishing is an online scam where attackers pose themselves as trusted organisations by email, text messages, advertisements, and other means to steal sensitive information.

There are two types of primary attacks

Standard attacks target a large group of people counting on one or more victims. The attacker only needs one successful victim to gain a foothold, so there are not many consequences.  The attackers and scammers target a group of audiences with bait.

Some examples of a standard attack

1. The attacker poses himself as a fake member of any department and sends the text or mail to the targeted group of people

2. The attacker would send mandatory online security training modules as bait so people receiving are convinced to take the training.

3. He steals information when people enter their credentials.

Spear phishing is a more targeted and more common attack. This attack targets fewer people. Hence it requires more time and effort from the attacker. This is done by a carefully manipulated email. The attackers spend some time gaining the trust of people. This attack is through malware on an internal network to steal sensitive information.

How has Phishing increased in 2023?

Phishing is the most common attack and is said to be increased by 30-40% over a  year. The most targeted industry of Phishing attacks is education, finance, and government.

With increasing bait tactics, it has become easy for attackers to get clicks on malicious links. Also, with the increased usage of social media platforms, attackers have more access to their targets, and it’s easy to steal their identity, and social media accounts.

Phishing attack has many origins today. People need to stay aware and updated about security and technology. They need to learn how to manage and protect their data, and identity.

Published by: Aliya Khan