Israeli company linked to Middle East cyberattacks

Published November 17, 2021
Israeli spyware company Candiru was blacklisted by the US government earlier this month. — AFP/File
Israeli spyware company Candiru was blacklisted by the US government earlier this month. — AFP/File

PARIS: Technology sold by Israeli spyware company Candiru appears to have been used for a campaign of cyberattacks targeting high-profile Middle Eastern websites, an analysis by cyber-security firm Eset said on Tuesday.

“We think it was a client of Candiru that carried out these attacks,” Eset investigator Matthieu Faou said.

Eset did not name the client, but pointed to an investigation by researchers at the University of Toronto that suggested in June that Saudi Arabia may have used similar techniques.

Based in Tel Aviv, Candiru sells sophisticated spyware to governments.

It was blacklisted by the US government earlier this month.

The offensive revealed by Eset used what are known as “watering hole” attacks, which add malicious code to legitimate websites that the targeted user is likely to visit.

Once the person visits the site, the code can then be used to infect their computer — potentially to spy on them or inflict harm in other ways.

The websites targeted in this campaign included UK-based news site Middle East Eye as well as Yemeni media outlets like Almasirah linked to the Houthi militants battling the Saudis, Eset said.

Another victim was thesaudireality.com, which Eset said was likely a dissident media outlet in Saudi Arabia.

Internet service providers in Yemen and Syria were also targeted along with the Iranian foreign ministry, Syria’s electricity ministry, and Yemen’s interior and finance ministries.

Other targets included sites run by the pro-Iranian group Hezbollah, Italian company Piaggio Aerospace and Denel, a state-owned South African aerospace and military technology conglomerate.

“The attackers also created a website mimicking a medical trade fair in Germany,” Eset noted in a press release, adding that the intrusions were recorded between July 2020 and August this year.

Candiru has earned comparisons with NSO, another Israeli company that was engulfed in scandal this year over accusations that governments used its Pegasus technology to spy on rights activists, politicians, journalists and business executives. The US government blacklisted NSO earlier this month, restricting exports from American firms.

Faou said the Candiru campaign did not appear to be aimed at mass data collection, specifically targeting a “very, very small” number of people.

Published in Dawn, November 17th, 2021

Editorial

27 Nov 2021

Supporting ECP

ALTHOUGH the government bulldozed legislation on electronic voting machines through parliament, the reality is that...
27 Nov 2021

Forgiving the Taliban

IF there is one takeaway from Thursday’s gathering of more than 1,000 Shia Hazaras in Kabul, it is the call given...
Living in fear
Updated 27 Nov 2021

Living in fear

THE registration of a blasphemy case against four members of a family from a village on the outskirts of Lahore has...
26 Nov 2021

State Bank’s projections

THE macroeconomic projections listed by the State Bank of Pakistan in its annual report on the nation’s economy...
Ad distribution
Updated 26 Nov 2021

Ad distribution

If present govt can muster will to achieve this task it would set a solid precedent that no future govt would find easy to undo.
26 Nov 2021

Messy passengers

NEWS that passengers on a PIA flight from Manchester to Islamabad left so much litter on the plane that it led to a...