At least nine human rights activists were targeted last year with attempting computer hacking, researchers at Canada-based Citizen Lab and Amnesty International said in a report on Monday, detailing an operation that used email-delivered links that would infect the target’s computer with commercially available spyware.
Among the targets were lawyers representing the activists arrested over the Bhima Koregaon case and some of who were subject to attacks through the Pegasus spyware that was delivered through WhatsApp.
“Between January and October 2019, each of the targets were sent spearphishing emails containing malicious links that, if opened, would have installed NetWire, a commercially available spyware,” they said in the blog post.
The targets were identified as lawyers Nihalsingh B Rathod, Isha Khandelwal, Degree Prasad Chauhan, Kolkata-based microbiologists Partho Sarathi Ray and Delhi-based academic PK Vijayan.
“This new investigation confirms that there is a pattern of targeted attacks against Human Rights Defenders in India, and more specifically against those advocating for the release of the Bhima Koregaon 11 (the arrested activists),” said Amnesty International’s Etienne Maynier, one of the researchers who worked on the investigation.
“The Indian government has a responsibility of addressing this issue and protecting the privacy and free speech of human rights defenders. We are thus calling on the Indian authorities to conduct an independent and transparent investigation on this unlawful surveillance,” he added.
{{/usCountry}}“The Indian government has a responsibility of addressing this issue and protecting the privacy and free speech of human rights defenders. We are thus calling on the Indian authorities to conduct an independent and transparent investigation on this unlawful surveillance,” he added.
{{/usCountry}}Spearphishing is a sophisticated cyber attack compared that is tailored to gain the target’s trust by, say, impersonating a known contact.
Screenshots shared by the researchers showed the suspect mail senders impersonated as activists the targets may have known and court officials purportedly sending summons. The mails were accompanied with a link to what appeared to be a PDF file.
According to the technical details published by the researchers, opening the PDF files would launch code that would install NetWire on a target’s Windows computer and also open an actual PDF file to minimize chances of suspicion.
In September, 2018, Citizen Lab disclosed an illegal surveillance operation with targets in 45 countries using Israel-based NSO Group’s Pegasus malware. The malware would be installed onto target’s phones using flaws in WhatsApp’s code, a software exploit that is now the subject of a lawsuit filed by the Facebook-owned company. In October, 2019, Citizen Lab reached out to a number of the victims, including some named above.
In a legal filing in April, NSO suggested some of its clients were nation-states when it hit back at WhatsApp and Facebook, saying they were seen as “safe spaces for terrorists and other criminals” who – without NSO’s services – could operate “without fear of detection by law enforcement”.