Software designed by the controversial surveillance firm NSO Group was used to target multiple senior officials of the European Commission in 2021, according to a new report from Reuters.
The Israeli-based company—known for its Pegasus spyware that has been used to target journalists, politicians, and executives all over the world—was blacklisted by the United States government in November 2021.
The U.S. Department of State said the move was made "based on a determination that they developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."
With the news coming out that this hacking tool was used to target senior EU officials, what should the rest of the world do regarding NSO Group?
Who was targeted with NSO software in the EU?
It appears that one of the European Commission members who was targeted is a senior Belgian statesman who has served as the European Justice Commissioner since 2019, named Didier Reynders. Reynders is one of at least four more members who were targeted.
Two EU officials who spoke with Reuters said the commission learned of the attacks after Apple issued messages to thousands of iPhone owners in November 2021 telling them they were "targeted by state-sponsored attackers." An email from an EU senior tech staff writer to those potentially affected said, "Given the nature of your responsibilities, you are a potential target."
This was the first time Apple had ever sent mass alerts to users letting them know that threat actors were targeting them because they worked in government.
There has been no determination as to who used the spyware to target these officials, whether the attempts were successful, and what the threat actors might have obtained if they were.
NSO denies involvement in EU hacking
Researchers say those that received warnings from Apple were targeted with the spyware between February and September 2021 using ForcedEntry, a piece of software developed by NSO Group to help foreign spy agencies take control of iPhones without the user ever knowing.
Though, in a recent statement, NSO told Reuters that it was not responsible for the hacking attempts and that it "could not have happened with NSO's tools."
Interestingly enough, there is a much smaller vendor who sells a nearly identical spyware tool to government clients, named QuaDream. QuaDream is also headquartered in Israel.
While there is no connection between the rival spyware companies, researchers were able to examine some of the EU officials' phones for signs of compromise, but the results were inconclusive.
The EU is currently taking steps similar to the U.S. in terms of spyware and is evaluating vendors like NSO.
NSO spyware has been at the center of some significant international controversy, including involvement in cases in which journalists were killed. Would the company really want to get mixed up in another scandal in which senior EU officials were targeted? Could it be its rival company, QuaDream?
See the original story from Reuters for more information.
