Dozens of journalists hacked by spyware company owned by Maltese citizen

Dozens of journalists were allegedly hacked with the help of spyware developed by Israeli firm NSO Group, a cyber-security company whose owner bought a Maltese passport and was arrested in the US months later.

NSO Group, known for creating surveillance software, including what Forbes called “the world’s most invasive mobile spy kit”, known as Pegasus, is linked to Maltese ‘citizen’ and alleged financial fraudster Anatoly Hurgin.

Hurgin obtained Maltese citizenship through the golden passport scheme and is facing charges of fraud, smuggling, and money laundering in Israel, as well as five violations of US federal law for defrauding shareholders of a Florida-based company.

Details of the recent alleged hack targeting 36 Al Jazeera journalists have been published in a report by Citizen Lab at the University of Toronto.

The report reveals that in July and August 2020, government operatives used NSO Group’s Pegasus spyware to hack 36 personal phones belonging to journalists, producers, anchors and executives at Al Jazeera. The personal phone of a journalist at London-based Al Araby TV was also hacked.

NSO Group has denied the allegation, saying it “lacks any evidence”.

NSO Group’s Pegasus spyware is a mobile phone surveillance solution that enables customers to remotely exploit and monitor devices. The company is a prolific seller of surveillance technology to governments around the world, and its products have been regularly linked to surveillance abuses.

Pegasus became known for the telltale malicious links sent to targets via SMS for many years. This method was used by NSO Group customers to target Ahmed Mansoor, dozens of members of civil society in Mexico, and political dissidents targeted by Saudi Arabia, among others, according to Citizen Lab.

More recently, NSO Group is shifting towards zero-click exploits and network-based attacks that allow its government clients to break into phones without any interaction from the target, and without leaving any visible traces. The 2019 WhatsApp breach, where at least 1,400 phones were targeted via an exploit sent through a missed voice call, is one example of such a shift.

Assassinated journalist Daphne Caruana Galizia had first raised the alarm about Hurgin when she wrote how he was previously a member of the Israeli Defence Forces (IDF) and that his companies Ability Inc, Ability Computers, Software industries Ltd and Active Intelligence Labs Ltd specialise in “phone hacking and cutting-edge surveillance technology.”

Among other criminal charges faced by Hurgin, Israeli authorities had arrested a number of employees from Ability Inc in September on suspicion of committing “offences of fraud, smuggling, and money laundering on a significant scale” while carrying out their business activities.

Last year, WhatsApp filed a lawsuit against the NSO Group for conducting cyber attacks that infected devices of journalists and activists with malicious software. WhatsApp accused the company of sending spyware to some 1,400 mobile phones with the purpose of surveillance. NSO Group has denied the allegations.