Researchers find Israeli-made spyware deployed across Armenia

© Reuters. FILE PHOTO: The logo of Israeli cyber firm NSO Group is seen at one of its branches in the Arava Desert, southern Israel July 22, 2021. REUTERS/Amir Cohen

By Raphael Satter and James Pearson (LON:PSON)

LONDON (Reuters) - Researchers have discovered Israeli-made Pegasus phone hacking software deployed against targets across Armenia, including reporters at a U.S. government-funded news organization, a report released on Thursday found.

A team of researchers from digital rights group Access Now, human rights organization Amnesty International, Canadian internet watchdog Citizen Lab, Armenian digital defense group CyberHUB-AM and independent researcher Ruben Muradyan, said they had confirmed at least 12 cases in which espionage software made by Israel's NSO Group had been used against Armenian officials, journalists and organizers.

What researchers were able to confirm "is the tip of the iceberg," said Natalia Krapiva, the tech-legal counsel for Access Now. "The targeting was quite extensive."

Pegasus is one of many advanced espionage tools that affords hackers sweeping access to their targets' smartphones, allowing them to record calls, intercept messages and even transform the phones into portable listening devices.

Researchers, lawmakers, and journalists have repeatedly accused the technology's maker, Israel-based NSO Group, of helping governments spy on political opponents. In 2021, the company was blacklisted by the U.S. government over human rights concerns.

In an email, NSO Group said it was unable to address the specific allegations made by the coalition of researchers but that it would "investigate all credible allegations of misuse".

The company has previously disputed accusations of wrongdoing, saying its software is used to fight terrorism and serious crime.

One of the alleged Armenian victims of NSO's spyware said those explanations do not reflect reality.

"That's a kind of ridiculous umbrella for the companies that create these products and the governments that use them," Armenian opposition broadcaster Samvel Farmanyan told Reuters.

He added that his targeting was "totally unacceptable (and had) nothing to do with the prevention of any type of crime or terrorism."

AZERBAIJAN DENIES RESPONSIBILITY

The researchers said they believed neighboring Azerbaijan, which has fought several wars with Armenia over the disputed chunk of territory known as Nagorno-Karabakh or Artsakh, was likely responsible for the hacking activity.

That's in part because of "extensive evidence" that Azerbaijan's government has previously used Pegasus against its domestic opponents, said Amnesty's Donncha O Cearbhaill, referring to a 2021 investigation by Amnesty and other partners that found hundreds of Azeri phone numbers had been selected for targeting with Pegasus spyware.

The Azeri Embassy in London said in a statement that Azerbaijan "does not engage in such practices" and "does not spy on foreign citizens".

The Armenian government has in the past been implicated in the deployment of phone hacking software, including in a report published last year by Alphabet (NASDAQ:GOOGL)'s Google.

While that report pointed to a different spyware, known as Predator, several Pegasus victims in Armenia said they feared their own government was behind the recent surveillance.

The Armenian Embassy in London said its government rejected the alleged use of spyware at the "highest level".

"Prime Minister Nikol Pashinyan made a strong public statement categorically rejecting the circulating information that the authorities used spyware against opponents and/or journalists," it said in a statement.

Pashinyan and family members had also received messages warning that their devices may have been compromised, it added.

Reuters spoke to several alleged victims identified by the researchers. All said Apple Inc (NASDAQ:AAPL) had sent them warnings in 2021 that their iPhones were at risk from spyware. They later discovered traces of Pegasus on their devices through forensic analyses.

Two of them were journalists with the U.S. government-funded Radio Free Europe/Radio Liberty (RFE/RL), something RFE/RL executive Patrick Boehler said was "truly terrifying and appalling".

"If we cannot protect our sources, it has consequences for the depth and breadth of our journalism," he said.

Other alleged victims included Varuzhan Geghamyan, an academic and expert on Armenian-Azeri relations, and Ruben Melikyan, a lawyer and human rights activist.

They all condemned the spying.

"Psychologically it's devastating," said Farmanyan, the broadcaster.