The danger of espionage under the gaze of an ethical hacker 0:40
Washington (CNN) -
Cybersecurity researchers from Facebook and a university uncovered a vast network of activities by commissioned spy companies from India to Israel that they claim have used hacking tools and hundreds of false identities. to monitor journalists, dissidents and politicians around the world.
As part of the investigation, Facebook's parent company Meta removed hundreds of Facebook and Instagram accounts linked to the seven different spy organizations, including Black Cube, the intelligence firm that the media mogul de Disgraced communication Harvey Weinstein allegedly hired to track down actresses and journalists, according to a New Yorker report.
Meta said it had notified some 50,000 people who had been targeted, in one way or another, by commissioned spy companies.
Investigations by Meta and the University of Toronto Citizen Lab offer two of the most in-depth analyzes to date of a booming private spy business that the Biden administration has tried to crack down on human rights concerns.
Hackers have breached defense organizations and other sensitive sectors, says security firm
Citizen Lab, a digital rights research center at the University of Toronto, discovered an invasive spy program, allegedly created by one of the surveillance companies, Cytrox, on the phone of former Egyptian presidential candidate Ayman Nour, critical of the president. Abdel Fattah el-Sisi.
"Although these 'cyber mercenaries' often claim that their services only target criminals and terrorists, our months-long investigation concluded that the target is indeed indiscriminate," and includes critics of authoritarian regimes and human rights activists. Meta researchers said in a report released Thursday.
advertising
Spy companies
The seven surveillance companies and organizations investigated by Meta offer their clients a full range of services, from easy-to-use hacking tools to infiltrate cell phones, to access to social media accounts to monitor targets.
Black Cube's services consisted of posing as film producers, graduate students, and non-governmental organization (NGO) workers to spy on targets around the world.
Another Israeli company, Bluehawk CI, used social media accounts to pose as journalists from Fox News and other media outlets in order to trick its targets into interviewing them on camera, according to Meta.
In addition to Black Cube, Bluehawk and Cytrox, Meta said it disabled Facebook and Instagram accounts linked to Israeli companies Cobwebs Technologies and Cognyte;
the Indian company BellTroX;
and to an entity in China not identified by name.
"We have not been contacted by Facebook (Meta) and we are unaware of any claims they have allegedly made about our services," Meital Levi Tal, a Cobwebs spokesperson, said in an email to CNN.
"CobWebs operates only in accordance with the law and adheres to strict regulations regarding the protection of privacy."
BellTroX could not be reached for comment.
None of the other four surveillance companies mentioned responded to CNN's requests for comment.
Facebook renamed his company Meta in October amid intense scrutiny from US lawmakers over how the platform handles disinformation that reverberates in the real world.
Meta removes hundreds of fake Facebook profiles in Nicaragua
Stay in the shade
The new discoveries show just how far private hired spies are willing to go to avoid public scrutiny and conceal their operations.
Cytrox, a dark business
software
spy, according to researchers at Citizen Lab, was established in Macedonia in the north, it is an example.
Cytrox has a corporate presence under various names in Israel and Hungary, the researchers said.
Industry analysts say surveillance Cytrox is one of several competitors in the market for the
software
spy NSO Group, the Israeli company that the Commerce Department has tried to
stop doing business with American technology companies.
Biden's government argues that the
software
spy NSO Group has been used by governments to attack foreign journalists and embassies.
NSO Group has rejected the allegations, stating that its products serve the interests of the national security of the United States.
Citizen Lab analyzed the phone of the Egyptian politician Nour and concluded that it had been hacked this summer by a spyware created by Cytrox and NSO Group.
Nour ran as a candidate for the Egyptian presidency against former authoritarian ruler Hosni Mubarak in 2005, and subsequently spent three years in prison charged with electoral fraud that was denounced by the United States.
Nour has lived in exile in Turkey for several years, where he has criticized el-Sisi, the current president of Egypt.
This company sells spy tools to many governments
In a statement released Thursday through his political party Ghad El-Thawra, Nour accused the governments of Egypt, Saudi Arabia and the United Arab Emirates of being involved in spying on his phone.
Nour told CNN that "I could not find any explanation or justification for the attack on my private life in such an unfortunate and unacceptable way, both legally and morally."
The embassies in Washington of Egypt, the United Arab Emirates and Saudi Arabia did not respond to a request for comment on the allegations on Thursday.
Bill Marczak, principal investigator at Citizen Lab, told CNN that "multiple factors point to the Egyptian government as responsible for the hacking" of Nour's phones and the host of a popular Egyptian news program, which Citizen Lab said preferred to remain. anonymous.
What is Pegasus spyware and how does it work?
We explain it to you in 12 points
"Our analysis identified the Government of Egypt as a Cytrox customer, the websites used in the hacks of the two targets had Egyptian themes, and the messages that initiated the hack were sent from Egyptian WhatsApp numbers," Marczak said.
It is unclear who used the Pegasus spyware on Nour's phone.
NSO Group did not respond to a request for comment.
Cytrox's founder is young entrepreneur Ivo Malinkovski, according to digital records reviewed by Citizen Lab and North Macedonian press articles.
At least as of Wednesday, Malinkovski's LinkedIn page featured a photo of him with a Cytrox cup of coffee.
The photo was removed after CNN sent a message to the LinkedIn account seeking comment.
- CNN's Natasha Bertrand contributed to this report.
Cyber espionageMeta