News
Lankans victim of India based cyber espionage?
Sri Lanka is among the south Asian nations where people’s data had been harvested by an India-based threat actor dubbed Patchwork, says the Hacker News.
It said that the Meta has uncovered massive social media cyber espionage operations across South Asia, adding that three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks.
“Each of these advanced persistent threats (APTs) relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet,” Guy Rosen, chief information security officer at Meta, said. “This investment in social engineering meant that these threat actors did not have to invest as much on the malware side.”
The fake accounts, in addition to using traditional lures like women looking for a romantic connection, masqueraded as recruiters, journalists, or military personnel.
At least two of the cyber espionage efforts entailed the use of low-sophistication malware with reduced capabilities, likely in an attempt to get past app verification checks established by Apple and Google.
One of the groups that came under Meta’s radar is a Pakistan-based advanced persistent threat (APT) group that relied on a network of 120 accounts on Facebook and Instagram and rogue apps and websites to infect military personnel in India and among the Pakistan Air Force with GravityRAT under the guise of cloud storage and entertainment apps.
The tech giant also expunged about 110 accounts on Facebook and Instagram linked to an APT identified as Bahamut that targeted activists, government employees, and military staff in India and Pakistan with Android malware published in the Google Play Store. The apps, which posed as secure chat or VPN apps, have since been removed.
Lastly, it purged 50 accounts on Facebook and Instagram tied to an India-based threat actor dubbed Patchwork, which took advantage of malicious apps uploaded to the Play Store to harvest data from victims in Pakistan, India, Bangladesh, Sri Lanka, Tibet, and China.
Also disrupted by meta are six adversarial networks from the U.S., Venezuela, Iran, China, Georgia, Burkina Faso, and Togo that engaged in what it called “coordinated inauthentic behavior” on Facebook and other social media platforms like Twitter, Telegram, YouTube, Medium, TikTok, Blogspot, Reddit, and WordPress.
All these geographically dispersed networks are said to have set up fraudulent news media brands, hacktivist groups, and NGOs to build credibility, with three of them linked to a U.S.-based marketing firm named Predictvia, a political marketing consultancy in Togo known as the Groupe Panafricain pour le Commerce et l’Investissement (GPCI), and Georgia’s Strategic Communications Department.
Two networks that originated from China operated dozens of fraudulent accounts, pages, and groups across Facebook and Instagram to target users in India, Tibet, Taiwan, Japan, and the Uyghur community.
In both instances, Meta said it took down the activities before they could “build an audience” on its services, adding it found associations connecting one network to individuals associated with a Chinese IT firm referred to as Xi’an Tianwendian Network Technology.
The network from Iran, per the social media giant, primarily singled out Israel, Bahrain, and France, corroborating an earlier assessment from Microsoft about Iran’s involvement in the hacking of the French satirical magazine Charlie Hebdo in January 2023.
“The people behind this network used fake accounts to post, like and share their own content to make it appear more popular than it was, as well as to manage Pages and Groups posing as hacktivist teams,” Meta said. “They also liked and shared other people’s posts about cyber security topics, likely to make fake accounts look more credible.”
The disclosure also coincides with a new report from Microsoft, which revealed that Iranian state-aligned actors are increasingly relying on cyber-enabled influence operations to “boost, exaggerate, or compensate for shortcoming in their network access or cyberattack capabilities” since June 2022.
The Iranian government has been linked by Redmond to 24 such operations in 2022, up from seven in 2021, including clusters tracked as Moses Staff, Homeland Justice, Abraham’s Ax, Holy Souls, and DarkBit. Seventeen of the operations have taken place since June 2022.
The Windows maker further said it observed “multiple Iranian actors attempting to use bulk SMS messaging in three cases in the second half of 2022, likely to enhance the amplification and psychological effects of their cyber-influence operations.”
The shift in tactics is also characterized by the rapid exploitation of known security flaws, use of victim websites for command-and-control, and adoption of bespoke implants to avoid detection and steal information from victims.
The operations, which have singled out Israel and the U.S. as a retaliation for allegedly fomenting unrest in the nation, have sought to bolster Palestinian resistance, instigate unrest in Bahrain, and counter the normalization of Arab-Israeli relations.
News
Fuel crunch looms
Govt. tells fuel distributors to maintain stocks to ensure uninterrupted supplies
by Saman Indrajith and Norman Palihawadane
The government had instructed private fuel distributors to maintain minimum stocks and ensure uninterrupted supplies to the market, Energy Minister Anura Karunathilaka told Parliament yesterday (06).
Karunathilaka said the Ministry of Energy Secretary had notified the relevant companies of the requirement, following a reduction in supplies by some private distributors, amid higher international fuel prices.
The Minister said private companies had informed the government that they were facing losses because international prices had risen while fuel was being sold, locally, at prevailing prices. As a result, some companies had reduced the volumes released to the market.
The reduced supplies had increased the burden on the Ceylon Petroleum Corporation (CPC), whose share of the diesel market had risen from about 54% to 82%, the Minister said.
“The CPC currently holds an 82% share of the market,” he said, adding that it had increased its supplies, compared with February, to compensate for the reduction by private distributors.
Karunathilaka said the government could not, under the existing agreements with private companies, specify the quantities they should supply to individual filling stations. However, it could require them to maintain minimum stocks in the country.
The Minister said the Energy Ministry had already instructed companies that had failed to maintain the required stocks to take steps to prevent supply disruptions.
The Minister attributed the queues reported at some filling stations to reduced supplies from private distributors, as well as normal variations in fuel distribution. He also said demand for CPC fuel had increased because private companies generally did not provide fuel to dealers on credit, while the CPC offered a three-day credit facility.
“We expect that, as the Ceylon Petroleum Corporation takes on this additional burden, the problem will ease to some extent by Wednesday or Thursday,” Karunathilaka said.
He said instructions had also been issued to increase supplies to CPC filling stations. A special discussion on the issue is scheduled for today (07), with officials of the Energy Ministry and CPC expected to participate,
along with President Anura Kumara Dissanayake.
Meanwhile, Petroleum Dealers’ Association officials have called for an early solution to the supply issue. Association Chairman D.V. Shantha Silva said queues had been reported at many filling stations, mainly those operated by private distributors.
He said the situation was not due to an overall shortage of fuel, but was linked to reduced orders by Lanka IOC, Sinopec and R.M. Parks amid concerns over losses incurred on fuel sales.
The Ceylon Petroleum Private Tanker Owners Association has urged motorists to refrain from panic buying, saying there was no nationwide disruption to fuel supplies.
The government earlier increased fuel prices and introduced a per-litre diesel subsidy following concerns raised by distributors over rising international prices.
News
Gnansara Thera to be assigned to prison printing section: Officials
by Norman Palihawadane
Bodu Bala Sena General Secretary Ven. Galagodaatte Gnanasara Thera, who has been ordered by the court to serve the remainder of his prison sentence, is to be assigned to the prison ‘printing work party’, prison officials said yesterday.
The monk was produced before the Colombo High Court yesterday by prison officials in connection with a warrant issued by the court.
He appeared before the court in civilian attire.
Prison sources said arrangements were being finalised for his detention and that he would subsequently be assigned to the printing work party.
The Thera initially objected when prison officials instructed him to change from his robes into the attire worn by convicted prisoners.
He later agreed to wear the prescribed prison clothes, sources said.
The Supreme Court, in September, annulled the presidential pardon granted to Gnanasara Thera in 2019. He had been serving a six-year prison sentence imposed following his conviction for contempt of court but had served only about nine months when then President Maithripala Sirisena granted him a presidential pardon in May 2019.
Following the Supreme Court ruling, the Thera was required to serve the remainder of his sentence. He was subsequently reported missing, prompting the Court of Appeal to issue an open warrant for his arrest.
The Court of Appeal on Monday ordered the authorities to enforce the remainder of his prison sentence.
News
Speaker rejects Ajith Perera’s privilege complaint
Speaker Dr. Jagath Wickramaratne yesterday ruled that a privilege complaint submitted by SJB Kalutara District MP Ajith P. Perera did not constitute a prima facie breach of parliamentary privilege.
The ruling was made in response to a notice of privilege submitted by Perera on October 02.
Perera alleged that his parliamentary privileges had been breached over the failure to take formal action or reach a final decision on a written request submitted on August 03 by 18 Opposition MPs seeking the appointment of a Special Select Committee to investigate delays in the judicial system and prison overcrowding.
He had also requested that the matter be referred to the Committee on Ethics and Privileges for investigation and recommendations.
In his ruling, Speaker Wickramaratne said the Speaker, as the Presiding Authority and guardian of the powers, rights and privileges of Parliament, could not be subjected to a privilege complaint or disciplinary inquiry by a committee subordinate to the Chair in respect of actions taken in an official capacity.
He said that, under the Standing Orders, the Speaker was required to independently determine whether a prima facie case of breach of privilege existed.
Referring a complaint against the Speaker to a committee functioning under the Speaker’s authority would, therefore, create a procedural contradiction, he said.
Accordingly, the Speaker ruled that Perera’s notice did not constitute a prima facie breach of parliamentary privilege and disallowed the request to refer the matter to the Committee on Ethics and Privileges.
-
News6 days agoUS-assisted ‘Ice’ detection: NPC to examine IGP’s move to transfer drug-busting team
-
Editorial5 days agoColombo Port drug bust: The plot thickens
-
Editorial6 days agoDrug busting, transfers and trust deficit
-
Features3 days agoThe first woman in the foreign service or Ceylon Overseas Service it was then called
-
Editorial4 days agoFuelling discontent and protest
-
News6 days agoSri Lankan facing death penalty in Saudi Arabia: Mano G appeals to Crown Prince
-
Latest News4 days agoTharindu Rathnayake, bowlers secure Asian Games Bronze for Sri Lanka
-
News2 days agoGeneva takes up Sallay’s case and govt. ignores opportunity to answer accusations
