Connect with us

Hi, what are you looking for?


Application Security

Calls Mount for US Gov Clampdown on Mercenary Spyware Merchants

Cybersecurity professionals from Google’s threat hunting unit and the University of Toronto’s Citizen Lab are upping the pressure on mercenary hacking firms selling high-end surveillance spyware with fresh calls for the U.S. government to urgently clamp down on these businesses.

Cybersecurity professionals from Google’s threat hunting unit and the University of Toronto’s Citizen Lab are upping the pressure on mercenary hacking firms selling high-end surveillance spyware with fresh calls for the U.S. government to urgently clamp down on these businesses.

In prepared remarks during a House Intelligence Committee hearing this week, Google’s Shane Huntley called on Congress to consider a “full ban” on federal procurement of commercial spyware technologies and urged expanded U.S. government sanctions against two notorious vendors — NSO Group and Candiru.

“We welcome recent steps taken by the government in applying sanctions to the NSO Group and Candiru, and we believe other governments should consider expanding these restrictions,” Huntley argued, before urging the U.S. government to consider a full ban on buying these products and the addition of new sanctions “to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment.”

“The U.S. could also set an example to other governments by reviewing and disclosing its own historical use of these tools,” Huntley told the Permanent Select Committee on Intelligence.

[ WATCH: Fireside Chat with Google Malware Hunter Shane Huntley ]

Huntley, who runs the Google Threat Analysis Group (TAG) and has been closely involved in documenting the use of zero-day exploits, said the rampant abuse of commercial spyware tools and ongoing use of zero-day exploits against widely deployed software have become too dangerous to society.

In fact, according to Huntley, the U.S. Intelligence Community should make it a priority to identify and analyze threats from foreign commercial spyware providers “as being on par with other major advanced threat actors.”

Advertisement. Scroll to continue reading.

Israel-based NSO Group and Candiru have been outed among a growing list of hack-for-hire companies using zero-days and sophisticated exploit chains to infect the most modern  Windows and iOS/macOS-powered machines.

Earlier this week, Microsoft threat research units warned that an Austrian company called DSIRF was caught exploiting zero-day flaws in Windows and Adobe software products in “limited and targeted attacks.” 

In addition to NSO Group, Candiru and DSIRF, there have been public documentation (.pdf) of several vendors operating in this murky space, a list that includes Cytrox, Cobwebs Technologies, Cognate, Black Cube, Bluehawk CI, BellTroX. Cytrox has been linked to the ‘Predator’ iPhone spyware suite caught on phones belonging to European politicians.

[ READ: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits ]

As the exploitation and spyware discoveries mount, Huntley called on the United States to pay close attention to foreign governments who harbor problematic vendors and undertake diplomatic efforts to limit harms caused by the mercenary spyware industry.

“Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated,” he added.

In separate testimony at the hearing, Citizen Lab senior researcher John Scott-Railton called attention to “pay-to-play government customers” that provide a steady supply of business to the mercenary spyware industry.

“In many cases, the talent pool of mercenary spyware developers draws from veterans of the intelligence services of U.S. allies. This includes countries with whom the U.S. has intelligence-sharing relationships,” Scott-Railton said. “While some pay-to-play customers are situated within governments with a degree of oversight, many are operating without any clear oversight or accountability. Predictably, this ballooning customer list is responsible for many of the abuses that have been uncovered,” he added.

[ READ: Citizen Lab Exposes Cytrox as Vendor Behind ‘Predator’ iPhone Spyware ]

Scott-Railton used the spotlight of the hearing to underscore just how invasive and powerful the commercial spyware products can be, warning the Intelligence Committee that it’s very difficult detect these hacking attacks at scale.

“The mercenary spyware industry knows that expanding espionage capabilities is a core part of their business model. But, it is inconvenient for them to acknowledge, as this quickly leads to the critical question: when does the industry become a threat to the U.S. national security and counterintelligence?” Scott-Railton asked.

He noted that U.S. government personnel “are not very well protected” from mercenary spyware, pointing to evidence showing at least nine U.S. officials had their phones infected by NSO Group’s Pegasus spying tool.

Scott-Railton said his research team has seen “troubling cases” suggesting that non-state actors may be accessing or directing the use of mercenary spyware, pointing to reports out of Mexico that commercial spyware tools “may be ending up in the hands of cartels.”

More directly, the Citizen Lab security expert called on Congress to direct the U.S. Intelligence Community to identify problematic mercenary spyware companies and use all tools to counter and disrupt their activities.

“Congress should develop legislation ensuring comprehensive U.S. export control and transparency requirements for domestically-developed spyware, including extensive due diligence for national security risks and human rights concerns,” he argued.

Related: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits 

Related: Victim of Private Spyware Warns It Can be Used Against US

Related: Microsoft: Austrian Company Exploiting Windows, Adobe Zero-Days

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...