News

Lankans victim of India based cyber espionage?

Published

3 years ago

2023/05/9

Sri Lanka is among the south Asian nations where people’s data had been harvested by an India-based threat actor dubbed Patchwork, says the Hacker News.

It said that the Meta has uncovered massive social media cyber espionage operations across South Asia, adding that three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks.

“Each of these advanced persistent threats (APTs) relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet,” Guy Rosen, chief information security officer at Meta, said. “This investment in social engineering meant that these threat actors did not have to invest as much on the malware side.”

The fake accounts, in addition to using traditional lures like women looking for a romantic connection, masqueraded as recruiters, journalists, or military personnel.

At least two of the cyber espionage efforts entailed the use of low-sophistication malware with reduced capabilities, likely in an attempt to get past app verification checks established by Apple and Google.

One of the groups that came under Meta’s radar is a Pakistan-based advanced persistent threat (APT) group that relied on a network of 120 accounts on Facebook and Instagram and rogue apps and websites to infect military personnel in India and among the Pakistan Air Force with GravityRAT under the guise of cloud storage and entertainment apps.

The tech giant also expunged about 110 accounts on Facebook and Instagram linked to an APT identified as Bahamut that targeted activists, government employees, and military staff in India and Pakistan with Android malware published in the Google Play Store. The apps, which posed as secure chat or VPN apps, have since been removed.

Lastly, it purged 50 accounts on Facebook and Instagram tied to an India-based threat actor dubbed Patchwork, which took advantage of malicious apps uploaded to the Play Store to harvest data from victims in Pakistan, India, Bangladesh, Sri Lanka, Tibet, and China.

Also disrupted by meta are six adversarial networks from the U.S., Venezuela, Iran, China, Georgia, Burkina Faso, and Togo that engaged in what it called “coordinated inauthentic behavior” on Facebook and other social media platforms like Twitter, Telegram, YouTube, Medium, TikTok, Blogspot, Reddit, and WordPress.

All these geographically dispersed networks are said to have set up fraudulent news media brands, hacktivist groups, and NGOs to build credibility, with three of them linked to a U.S.-based marketing firm named Predictvia, a political marketing consultancy in Togo known as the Groupe Panafricain pour le Commerce et l’Investissement (GPCI), and Georgia’s Strategic Communications Department.

Two networks that originated from China operated dozens of fraudulent accounts, pages, and groups across Facebook and Instagram to target users in India, Tibet, Taiwan, Japan, and the Uyghur community.

In both instances, Meta said it took down the activities before they could “build an audience” on its services, adding it found associations connecting one network to individuals associated with a Chinese IT firm referred to as Xi’an Tianwendian Network Technology.

The network from Iran, per the social media giant, primarily singled out Israel, Bahrain, and France, corroborating an earlier assessment from Microsoft about Iran’s involvement in the hacking of the French satirical magazine Charlie Hebdo in January 2023.

“The people behind this network used fake accounts to post, like and share their own content to make it appear more popular than it was, as well as to manage Pages and Groups posing as hacktivist teams,” Meta said. “They also liked and shared other people’s posts about cyber security topics, likely to make fake accounts look more credible.”

The disclosure also coincides with a new report from Microsoft, which revealed that Iranian state-aligned actors are increasingly relying on cyber-enabled influence operations to “boost, exaggerate, or compensate for shortcoming in their network access or cyberattack capabilities” since June 2022.

The Iranian government has been linked by Redmond to 24 such operations in 2022, up from seven in 2021, including clusters tracked as Moses Staff, Homeland Justice, Abraham’s Ax, Holy Souls, and DarkBit. Seventeen of the operations have taken place since June 2022.

The Windows maker further said it observed “multiple Iranian actors attempting to use bulk SMS messaging in three cases in the second half of 2022, likely to enhance the amplification and psychological effects of their cyber-influence operations.”

The shift in tactics is also characterized by the rapid exploitation of known security flaws, use of victim websites for command-and-control, and adoption of bespoke implants to avoid detection and steal information from victims.

The operations, which have singled out Israel and the U.S. as a retaliation for allegedly fomenting unrest in the nation, have sought to bolster Palestinian resistance, instigate unrest in Bahrain, and counter the normalization of Arab-Israeli relations.

All News Advertisement

Related Topics:Cyber Attack in India Hacker News

Up Next

Maldives:IFJ critical of inaction on Journalist sexual harassment case

Don't Miss

Rahmanullah, Avishka and Binura star in Jaffna Kings third win in LPL 2022

Click to comment

News

Fast Attack Craft P 4447 recovered in successful salvage operation

Published

4 hours ago

2026/09/14

Priyan

The Sri Lanka Navy successfully recovered its Fast Attack Craft P 4447 following a successful salvage operation, bringing a multi-stage emergency response to a close.

The craft, which ran into distress during a routine patrol on 15th August 2026 off Angulana, was brought to the surface on 11th September, from a depth of approximately 80 feet. It was
subsequently towed to the Colombo Dockyard premises.
The initial phase of the operation immediately following the incident focused on search and rescue. A joint effort involving the Navy, Air Force, Police, and local fishermen from Angulana
resulted in the rescue of 11 crew members. The search and rescue phase drew to a close with the recovery of the remains of the Second in Command of the craft, on 4th September.

Following the search and rescue phase, specialized Navy diving and salvage teams launched a dedicated recovery phase against rough sea conditions and underwater challenges, adhering to
strict safety protocols. The Navy’s marine, hull, electrical, and electronic engineering teams utilized specialized technical know-how and equipment to raise the vessel in stages.

Thus, the salvage operation marked an outstanding achievement attained through the professionalism, technical expertise of Navy divers, and coordinated contribution of all
engineering and technical branches of the Sri Lanka Navy. Technical support and specialized expertise were also extended by the Sri Lanka Ports Authority and Colombo Dockyard PLC.

News

CIABOC member’s appointment: Controversy over Speaker under probe heading selection process

Published

6 hours ago

2026/09/14

Thilina Walpola

By Shamindra Ferdinando

The Opposition should intensity its focus on the forthcoming selection of a member of the Commission to Investigate Allegations of Bribery or Corruption (CIABOC) and remain vigilant as Speaker Dr. Jagath Wickremaratne, MP, the head of the Constitutional Council (CC) tasked with making the relevant recommendation, is under investigation by the CIABOC, sources familiar with the ongoing inquiry told The Island.

Chethiya Goonasekara, PC, is expected to complete his three-year term on Dec 31, 2026. Sources pointed out that CIABOC Commissioners are appointed by the President on the recommendation made by the 10-member Constitutional Council.

The CIABOC initiated the investigation following a complaint lodged by suspended Chief of Staff and Deputy Secretary General of Parliament Chaminda Kularatne in early February this year. Sources said that as Goonasekera is scheduled to complete his term toward the end of 2026, the CC would have to call applications soon to choose the successor.

Goonasekara received his appointment from President Ranil Wickremesinghe in January 2024. A Justice W. M. N. P. Iddawala was appointed Chairman of the CIABOC. The other commissioner is K. Bernard Rajapakse.

Asked whether Iddawala and Rajapakse, too, would complete their terms soon, sources said that in terms of the Anti-Corruption Act No 09 of 2023, the Chairman of CIABOC would hold office for a period of five years, second commissioner (K. Bernard Rajapakse) for four years and the third commissioner (Chethiya Goonasekara) for a period of three years.

Sources said that the Opposition as well as civil society representatives in the CC should take up the issue of Speaker facing an investigation by the CIABOC taking part in the forthcoming selection process. Responding to queries, sources emphasized that the issue was whether in terms of Section 107 of the Anti-Corruption Act the participation of the Speaker in the selection process amounted to a violation of the Act itself.

The current members of the CC are Dr Jagath Wickramaratne, Speaker and Chairman of the Constitutional Council, Dr. Harini Amarasuriya, Prime Minister, Sajith Premadasa, Leader of the Opposition, Bimal Rathnayake, MP, Aboobucker Athambawa, MP, Ajith P. Perera, MP, Sivagnanam Shritharan, MP, Austin Fernando, Civil society representative, Prof. Wasantha Seneviratne, Civil society representative and Ranjith Ariyaratne, Civil society representative.

Sources pointed out that in spite of the sensitivity of the case, the CIABOC recorded Kularatne’s statement in the second week of August, six months after he lodged the complaint.

The CIABOC on 3, 8 and 10 Sept recorded the statements from the Transport Officer, Deputy Director, Administration and Assistant Director, Finance regarding the use of facilities by the Speaker, those assigned to his staff and other relevant matters.

The NPP named Dr. Wickramaratne as the Speaker after Asoka Ranwala resigned over controversy regarding his higher education qualifications.

SJB lawmaker Dayasiri Jayaskera has repeatedly raised the issues concerning the Speaker with the focus also on the Speaker using two government-managed residences, relevant staff in addition to expenditure on food, transport and fuel provided to the Speaker’s private secretary.

Political sources said that trouble erupted after the Parliamentary Staff Advisory Council in late January sacked Kularatne accusing him of providing false information to secure his appointment. Before being appointed as the Deputy Secretary-General of Parliament in 2023, Kularatne held several high-ranking positions, including Secretary to the Chief Government Whip, Additional Secretary to the President, Additional Secretary to the Prime Minister, and Additional Secretary to the Leader of the Opposition.

The SJB declared in Parliament that Ranwala should be brought back as the Speaker as they have no faith in Wickramaratne. MP Mujibur Rahuman jokingly told parliament that the Opposition wouldn’t raise Ranwala’s educational qualifications.

News

GMOA: Countrywide cadre revision not done since 2015

Published

6 hours ago

2026/09/14

Thilina Walpola

Dhammika

The Government Medical Officers’ Association (GMOA) has stressed the need to conduct a comprehensive countrywide cadre revision urgently.

GMOA spokesman Dr. Lasitha Dhammika told The Island that the failure on the part of successive governments to conduct cadre revision caused the deterioration of the public sector health services. Due to the absence of required statistics, they hadn’t been able to fully comprehend the situation on the ground and to ascertain the requirements of the public.

Dr. Dhammika pointed out the expansion of the services without supporting statistics and the need to initiate an immediate cadre revision. According to him, the GMOA had raised this issue with successive governments without success. The GMOA spokesman said that they also sought relevant information from the Health Ministry in terms of the Right to Information (RTI) Act two weeks ago but was yet to receive response.

(SF)