Spyware, hacking create a stir in Jordan
Israeli-made Pegasus spyware was used in Jordan to hack the cellphones of at least 30 people, including journalists, lawyers, and human rights and political activists, the digital rights group Access Now said Thursday.
The hacking with spyware made by Israel’s NSO Group occurred from 2019 until last September, Access Now said in its report. It did not accuse Jordan’s government of the hacking.
One of the targets was Human Rights Watch’s deputy director for the region, Adam Coogle, who said in an interview that it was difficult to imagine who other than Jordan’s government would be interested in hacking those who were targeted.
The Jordanian government had no immediate comment on Thursday’s report.
In a 2022 report detailing a much smaller group of Pegasus victims in Jordan, digital sleuths at the University of Toronto’s Citizen Lab identified two operators of the spyware it said may have been agents of the Jordanian government. A year earlier, Axios reported on negotiations between Jordan’s government and NSO Group.
“We believe this is just the tip of the iceberg when it comes to the use of Pegasus spyware in Jordan, and that the true number of victims is likely much higher,” Access Now said. Its Middle East and North Africa director, Marwa Fatafta, said at least 30 of 35 known targeted individuals were successfully hacked.
Citizen Lab confirmed all but five of the infections, with 21 victims asking to remain anonymous, citing the risk of reprisal. The rest were identified by Human Rights Watch, Amnesty International’s Security Lab, and the Organized Crime and Corruption Reporting Project.
NSO Group says it only sells to vetted intelligence and law enforcement agencies — and only for use against terrorists and serious criminals. But cybersecurity researchers who have tracked the spyware’s use in 45 countries have documented dozens of cases of politically motivated abuse of the spyware — from Mexico and Thailand to Poland and Saudi Arabia.
An NSO Group spokesperson said the company would not confirm or deny its clients’ identities. NSO Group says it vets customers and investigates any report its spyware has been abused.
The U.S. government was unpersuaded and blacklisted the NSO Group in November 2021, when iPhone maker Apple Inc. sued it, calling its employees “amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse.”
Those targeted in Jordan include Human Rights Watch’s senior researcher for Jordan and Syria, Hiba Zayadin. Both she and Coogle had received threat notifications from Apple on Aug. 29 that state-sponsored attackers had attempted to compromise their iPhones.
Coogle’s local, personal iPhone was successfully hacked in October 2022, he said, just two weeks after the human rights group published a report documenting the persecution and harassment of citizens organizing peaceful political dissent.
After that, Coogle activated “Lockdown Mode” on the iPhone, which Apple recommends for users at high risk.
Human Rights Watch said in a statement Thursday that it had contacted NSO Group about the attacks and specifically asked it to investigate the hack of Coogle’s device “but has received no substantive response to these inquiries.”
Jordanian human rights lawyer Hala Ahed — known for defending women’s and workers rights and prisoners of conscience — was also targeted at least twice by Pegasus, successfully in March 2021, then unsuccessfully in February 2023, Access Now said.
About half of those found to have been targeted by Pegasus in Jordan — 16 in all — were journalists or media workers, the report said.
ALBANIAN CYBERATTACK
Albania’s Institute of Statistics reported Thursday it has suffered a cyberattack which affected some of its systems.
A statement said Institute of Statistics, or INSTAT, systems were “a target of a sophisticated cyberattack” on Wednesday.
After closing internet links and activating emergency protocols to protect data, experts determined that only “some of INSTAT systems were affected,” but not those for a recent census.
INSTAT is cooperating with authorities to identify the source and motives of the cyberattack, resume normal functioning and strengthen cybersecurity, the statement on its Facebook page said.
In December, a cyberattack hit the country’s Parliament website.
Albania also suffered a cyberattack in July 2022 that the government and international technology companies blamed on the Iranian Foreign Ministry. The attack, believed to be in retaliation for Albania sheltering members of the Iranian opposition group Mujahedeen-e-Khalq, or MEK, led the government to cut diplomatic relations with Iran two months later.