Facebook has shut down more than 30 accounts that were found to be spreading Remote Access Trojans<\/a> (RATs) through malicious links that claimed to inform users about the ongoing political crisis in Libya.<\/p>\n Dubbed \u2018Operation Tripoli,\u2019 the large-scale campaign \u2014 uncovered by cybersecurity vendor Check Point Research<\/a> \u2014 found that these pages have been a malware distribution point at least since 2014, potentially infecting thousands of victims.<\/p>\n According to researchers, the accounts \u2014 some with over 100,000 followers \u2014 lured unsuspecting victims into \u201cclicking links and downloading files that are supposed to inform about the latest airstrike in the country, or the capturing of terrorists, but instead contain[ed] malware.\u201d<\/p>\n The incident serves as a reminder how social media platforms can be abused to launch malware attacks, even as companies are investing in a variety of automated and manual systems to keep malicious activities at bay.<\/p>\n Researchers said they began investigating the campaign after spotting a Facebook page impersonating the commander of Libya\u2019s National Army, Khalifa Haftar, who is also a prominent Libyan-American political figure in the country.<\/p>\n The Facebook page \u2014 created in April 2019 with over 11,000 followers \u2014 shared posts with links disguised as leaks from Libya\u2019s intelligence units.<\/p>\n These leaks were purported to \u201ccontain documents exposing countries such as Qatar or Turkey conspiring against Libya, or photos of a captured pilot that tried to bomb the capital city of Tripoli.\u201d\u00a0Some URLs even urged users to download mobile apps that were meant for citizens interested in joining the Libyan armed forces.<\/p>\n But in reality, these URLs attempted to download malicious scripts and rogue Android apps that were\u00a0variants of open source remote-administration tools like Houdini, Remcos, and SpyNote which grant the attacker remote access to the devices to stage various attacks.<\/p>\n In a further attempt to mask their true intent, the URLs were concealed using URL shortening services like bit.ly and goo.gl. Secondly, the malicious scripts themselves were found to be stored in file hosting services such as Google Drive, Dropbox, and Box.<\/p>\n But they also found instances where the attacker managed to host malicious files on legitimate websites, including Libyana<\/a>, one of the largest mobile operators in Libya.<\/p>\n \u201cAlthough the set of tools which the attacker utilized is not advanced nor impressive per se, the use of tailored content, legitimate websites and highly active pages with many followers made it much easier to potentially infect thousands of victims,\u201d Check Point researchers noted.<\/p>\n The Facebook posts were found to be riddled with \u201cmany misspelled words, missing letters, and repeated typos in Arabic.\u201d The spelling mistakes were a vital clue in confirming that the content was generated by an Arabic speaker, as they were unlikely to be introduced by online translation engines.<\/p>\n A lookup of some combinations of the incorrect phrasing led the researchers to a network of Facebook pages that contained the same unique mistakes, proving that they were all operated by the same threat actor.<\/p>\n The malicious script files shared by the original Facebook page were all traced to the same command-and-control (C&C) server with the domain name: drpc.duckdns[.]org.<\/p>\n A C&C server is typically a computer controlled by a cybercriminal which is used to issue commands to systems compromised by malware and receive stolen data from a target network.<\/p>\n They also established that the domain resolved to an IP address that was associated with another website: libya-10[.]com[.]ly, which coincidentally was also used as a C&C server to distribute malicious files back in 2017.<\/p>\n Through a subsequent WHOIS domain lookup, the researchers ascertained that someone under the alias \u201cDexter Ly\u201d had registered both the domains using the email address drpc1070@gmail.com.<\/p>\n The alias led the researchers to yet another Facebook account, which was found to repeat the same typos discovered in the earlier pages. A closer inspection of the account\u2019s Facebook habits also revealed that the attacker was able to get their hands on sensitive information belonging to government officials.<\/p>\n The use of URL shortening services to generate the links allowed Check Point researchers to determine how many times a given link had been clicked and from what geographic location.<\/p>\n The analysis revealed that Facebook pages were the most common source of the links. Most of the clicks themselves came from Libya. But it was also confirmed that the campaign reached as far as\u00a0Europe, the US, and Canada. It\u2019s worth noting here that a click doesn\u2019t necessarily mean a successful infection.<\/p>\n Facebook has since shut down the pages and accounts that were distributing the malware as part of the campaign after Check Point researchers privately reported their findings.<\/p>\n But considering the ongoing conflict in Libya between the elected government backed by the United Nations and Haftar-led Libyan National Army, the attacker\u2019s decision to exploit the crisis to bait users into clicking the malicious URLs raises serious security concerns. It also highlights\u00a0how social engineering attacks<\/a> are gaining sophistication.<\/p>\n \u201cAlthough the attacker does not endorse a political party or any of the conflicting sides in Libya, their actions do seem to be motivated by political events,\u201d the researchers concluded.<\/p>\n The chain of events indicate that the threat actor leveraged Facebook\u2019s reach, and that they were aware of what their targets were likely to click or download, thereby enabling them to spread the files using simple yet effective methods.<\/p>\n<\/p><\/div>\nWhat was the Campaign?<\/h3>\n
![\"\"](\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2019\/07\/facebook-pages-796x302.png\")
![\"\"](\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2019\/07\/malware-drive-url.png\")
Who is the attacker?<\/h3>\n
The Impact<\/h3>\n
![\"\"](\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2019\/07\/malware-reach-796x305.png\")