Meta detects hacking group linked to Pakistan that targeted Indian military personnel

“We took action against about 120 accounts on Facebook and Instagram linked to a hacking group in Pakistan that predominantly targeted people in India and Pakistan, including military personnel in India and among the Pakistan Air Force. Our investigation connected it to state-linked actors in Pakistan,” Meta said in the report.

Meta said that while this group’s activity was relatively low in sophistication, it was persistent and targeted many services across the internet. They relied heavily on a web of attacker-controlled websites to distribute malware through highly targeted campaigns aimed to trick targets into clicking on malicious links and downloading Android or Windows malware.

Apart from deploying a wide range of tactics, including the use of custom applications and infrastructure, the group linked to state-actors in Pakistan also used fictitious personas — posing as recruiters for both legitimate and fake defence companies and governments, military personnel, journalists and women looking to make a romantic connection — in an attempt to build trust with the people they targeted.

Patchwork, the hacker network based in India and consisting of around 50 accounts, relied on a range of elaborate fictitious personas to socially engineer people into clicking on malicious links and downloading malicious apps. “Some of them posed as journalists in the United Kingdom or United Arab Emirates working for both legitimate and fake media outlets, military personnel or defence intelligence consultants,” Meta said.

The company also detected six coordinated inauthentic behaviour (CIB) networks operating out of the United States, Venezuela, Iran, China, Georgia, Burkina Faso and Togo, which targeted Meta users across the world.

These CIB networks created fake entities on various social media platforms such as Facebook, Twitter, Telegram, YouTube, Medium, TikTok and others to build credibility, Meta said. “More than half of them targeted audiences outside of their countries. We removed the majority of these operations before they were able to build authentic audiences.”