Facebook says hackers backed by Vietnam’s government are linked to IT firm
Group is known for its robust, custom-made malware. IT firm says the link is a mistake. …
reader comments
14 with 13 posters participating
Facebook said it has linked an advanced hacking group widely believed to be sponsored by the government of Vietnam to what’s purported to be a legitimate IT company in that country.
The so-called advanced persistent threat group goes under the monikers APT32 and OceanLotus. It has been operating since at least 2014 and targets private sector companies in a range of industries along with foreign governments, dissidents, and journalists in South Asia and elsewhere. It uses a variety of tactics, including phishing, to infect targets with fully featured desktop and mobile malware that’s developed from scratch. To win targets’ confidence, the group goes to great lengths to create websites and online personas that masquerade as legitimate people and organizations.
Earlier this year, researchers uncovered at least eight unusually sophisticated Android apps hosted in Google Play that were linked to the hacking group. Many of them had been there since at least 2018. OceanLotus repeatedly bypassed Google’s app-vetting process, in part by submitting benign versions of the apps and later updating them to add backdoors and other malicious functionality.
FireEye published this detailed report on OceanLotus in 2017, and BlackBerry has more recent information here.
On Thursday, Facebook identified Vietnamese IT firm CyberOne Group as being linked to OceanLotus. The group lists an address in Ho Chi Minh city.
Email sent to the company seeking comment returned an error message that said the email server was misconfigured. A report from Reuters on Friday, however, quoted a person operating the company’s now-suspended Facebook page as saying: “We are NOT Ocean Lotus. It’s a mistake.”
At
Continue reading – Article source
