Facebook Inc on Wednesday said that it had blocked a group of hackers in China who used the platform to target Uighurs living abroad with links to malware that would infect their devices and enable surveillance.
The social media company said that the hackers, known as Earth Empusa or Evil Eye in the security industry, targeted advocates, journalists and dissidents who were predominantly Uighurs, a largely Muslim ethnic group facing persecution in China.
Facebook said that there were fewer than 500 targets, who were largely from the Xinjiang region, but were primarily living in other countries, including Australia, Canada, Kazakhstan, Syria, Turkey and the US.
Photo: AFP
It said that most of the hackers’ activity occurred away from Facebook and that they used the site to share links to malicious Web sites rather than directly sharing the malware on the platform.
“This activity had the hallmarks of a well-resourced and persistent operation, while obfuscating who’s behind it,” Facebook cybersecurity investigators said in a blog post.
Facebook said that the hacking group used fake Facebook accounts to pose as fictitious journalists, students, human rights advocates or members of the Uighur community to build trust with their targets and trick them into clicking malicious links that would install spying software on their devices.
Hackers set up malicious Web sites using look-alike domains for popular Uighur and Turkish news sites, and compromised legitimate Web sites visited by the targets, the company said.
Facebook also found Web sites created by the group to mimic third-party Android app stores with Uighur-themed apps, like a prayer app and dictionary app, containing malware.
China’s embassy in Washington did not immediately return a message seeking comment on Facebook’s report.
Western governments are seeking to hold Beijing accountable for mass detentions of Muslim Uighurs in northwestern China, where the US says China is committing genocide.
The UN estimates that up to 1 million people, mainly Uighurs, have been detained in the Xinjiang camps.
Facebook said it had removed the group’s accounts, which numbered less than 100, and had blocked the sharing of the malicious domains and was notifying people it believed were targets.
Comments will be moderated. Keep comments relevant to the article. Remarks containing abusive and obscene language, personal attacks of any kind or promotion will be removed and the user banned. Final decision will be at the discretion of the Taipei Times.