A former employee of Israel-based cyber arms dealer NSO Group has been accused of stealing spyware source code from the company and attempting to sell it for $50 million, Israel’s Justice Ministry announced this week.
The suspect has not been named, but court documents reveal that he’s a 38-year-old from Netanya hired by NSO as a senior programmer in the company’s automation team.
According to prosecutors, NSO informs employees that they are prohibited from copying any software from work devices, a rule that is enforced using a McAfee product that can prevent external storage units from being connected to computers.
Investigators claim that the suspect searched the Web for ways to bypass the security product, methods which he used to copy both NSO software and its source code following a poor performance review from his manager.
The suspect then allegedly searched the Internet for potential buyers of the spyware. He is said to have attempted to sell the files for $50 million in cryptocurrency on the dark web, but his potential buyer alerted NSO, which led to the employee’s dismissal and arrest. Investigators found the stolen files on an external drive hidden under a mattress in the suspect’s home.
Court documents show that the suspect told the potential buyer that he was a hacker who had broken into NSO’s systems.
Authorities allege that the defendant’s actions could have harmed state security and could have led to NSO’s collapse. However, the firm told Israeli media that the stolen files were not shared with a third party.
NSO Group, a company owned by US private equity firm Francisco Partners Management, is best known for Pegasus and Chrysaor, tools designed for spying on iOS and Android phones, respectively.
In 2016, Apple released an emergency patch for iOS after researchers discovered that Pegasus had been exploiting three zero-day vulnerabilities in the mobile operating system.
NSO claims to sell its tools only to governments to help them in their fight against terrorists and criminals. However, Pegasus has apparently been abused in some cases, including in Mexico, where the government was accused last year of using it to spy on journalists and activists.
According to recent reports, Verint Systems is in talks to acquire NSO for roughly $1 billion.
Related: Former SunTrust Employee Steals Details on 1.5 Million Customers
Related: Ex-CIA Employee Charged With Leaking Agency’s Hacking Tools
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- CISA, NSA Issue Guidance for IAM Administrators
- Analysis: SEC Cybersecurity Proposals and Biden’s National Cybersecurity Strategy
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- Tackling the Challenge of Actionable Intelligence Through Context
- Dole Says Employee Information Compromised in Ransomware Attack
- Backslash Snags $8M Seed Financing for AppSec Tech
