Religious, political leaders in Togo allegedly targeted with NSO Group spyware

Religious and political opposition leaders in Togo were targeted last year with spyware developed by NSO Group, according to Citizen Lab.

The list of people allegedly targeted by NSO Group surveillance software is growing by the day.

Religious and political opposition leaders in Togo were targeted last year with spyware developed by Israeli software surveillance firm NSO Group, according to security researchers at University of Toronto Munk School’s Citizen Lab.

Like many of the company’s past actions, the alleged NSO surveillance in Togo used Facebook’s WhatsApp to target religious clergy and politicians, Citizen Lab researchers said. The effort was part of a broader hacking campaign that targeted thousands of WhatsApp users with NSO Group spyware in 2019, according to Citizen Lab.

NSO Group has repeatedly said that its software is only sold to law enforcement or intelligence agencies in order to target terrorists and criminals. But the revelations about surveillance in Togo are just the latest allegations that NSO Group spyware has enabled surveillance of political opponents and other perceived government critics. Other alleged NSO Group victims include journalists in Morocco, Catalonian separatist leaders in Spain, and human rights activists in India.

The alleged surveillance in Togo came amid a longstanding political movement to impose presidential term limits in the country, a movement that the government has worked to restrict in recent years. The bishop and priest targeted in the alleged attacks, like the political dissidents, have been critical of the Togolese government, according to Citizen Lab.

It was not clear who was responsible for using the surveillance software, although some of the victims, including the bishop Monseigneur Benoît Comlan Alowonou, told The Guardian they believe the Togolese government is behind the campaign.

Citizen Lab previously reported in 2018 that there was at least one operator of NSO Group spyware in Togo that Citizen Lab “suspected” was “operated by an agency of the Togolese Government.” Citizen Lab did not explicitly blame the Togolese government for the allegations revealed Monday.

WhatsApp and Citizen Lab had previously informed the Togolese victims named Monday that they had been targeted by NSO Group spyware. This is the first time they are publicly revealing they were targeted, which The Guardian and Le Monde first reported.

Facebook has sued NSO Group in U.S. federal court over the sweeping campaign exploiting WhatsApp. Despite NSO Group’s efforts to get the case thrown out of court, a judge recently ruled the case could move forward. The case has not been resolved yet.

An NSO Group spokesperson told CyberScoop in a statement they “cannot confirm or deny” who the company’s customers are.

“[W]e are not privy to who our authorised and verified sovereign government clients target using our technology, though they are contractually obliged to only do so against terrorists and criminals. If an investigation is warranted, NSO will conduct one following our industry-leading human rights processes,” the spokesperson added. “We remain incredibly proud of our technology’s contribution in fighting terrorism and serious crime globally and our role in helping governments save lives.”

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Google and Amnesty International teamed up to make it harder for spyware vendors to hide

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems