Facebook has banned seven "surveillance-for-hire" companies from its platforms and will send warning notices to 48,000 people who the company believes were targeted by malicious activity, following a months-long investigation into the "cyber mercenary" industry.
The social media company said on Thursday that its investigation had revealed new details about the way the surveillance companies enable their clients to "indiscriminately" target people across the internet to collect intelligence about them, manipulate them - and ultimately compromise their devices.
Among the surveillance companies that Facebook named in its investigation and banned from its platforms are:
The investigation conducted by Facebook comes as the company is itself facing intense scrutiny in Washington and around the world following accusations by a whistleblower, Frances Haugen, that it enabled the spread of hate speech and disinformation.
The Facebook investigation is significant, however, because it reveals new details about the way parts of the surveillance industry use social media - from Facebook to Instagram - to create fake accounts to deceive their targets and conceal their own activities.
While many of the companies claim that they are hired to target criminals and terrorists, Facebook said the industry "regularly" enabled its clients to target journalists, dissidents, critics of authoritarian regimes and human rights activists and their families.
"Our hope is to contribute to the broader understanding of the harms this industry represents worldwide and call on the democratic governments to take further steps to help protect people and impose oversight on the sellers of ubiquitous spyware," the company said. It added that it had not only removed the companies' fake accounts from their platforms, but also issued cease and desist orders and would work to ensure that the companies did not seek to re-engage on their platforms.
Facebook said that not all of the 48,000 who would be alerted were hacked, though the company did believe they were the subject of "malicious activity".
It also pointed to recent and intense media focus on NSO Group, the Israeli spyware maker that was at the heart of the Pegasus Project, an investigation by the Guardian and other media outlets, and was recently blacklisted by the Biden administration. WhatsApp, which is owned by Facebook's parent company, Meta, sued NSO in 2019 and has been a leading critic of the company. NSO is not among the companies banned on Thursday.
"It's important to realize that NSO is only one piece of a much broader global cyber mercenary ecosystem," Facebook said.
As Facebook announced its investigation, leading researchers at Citizen Lab at the University of Toronto released a new report that zeroed in on one entity - Cytrox - whose spyware, called Predator, is alleged to have been used by an unknown client to hack the devices of two individuals.
One, Ayman Nour, is an exiled Egyptian politician who Citizen Lab said was found to have simultaneously been hacked by two different nation-state clients, one using Predator and another using Pegasus. Nour, who is based in Turkey, is the president of an Egyptian political opposition group called Union of the Egyptian National Forces and was a former presidential candidate who ran against former president Hosni Mubarak.
He was imprisoned for four years after his run over allegations - which were seen as being politically motivated - of forging signatures for petitions. He was released following international pressure. He was also an associate of Jamal Khashoggi, the Washington Post columnist who was murdered by Saudi agents in the Saudi consulate in 2018.
In an interview with the Guardian, Nour said it was painful to learn he had been hacked.
"There was a negative psychological impact on me. My kids live in the UK and US, and I live in a third country, Turkey, so being sure I was being spied on, I stopped communicating with my sons, because I fear for them," he said.
Nour said that he had held a Zoom meeting with Egyptians, Saudis and Emirates as part of a discussion about the use of the death penalty in Arab countries on the day researchers later learned he had been hacked.
A second target, who has remained anonymous, was described by Citizen Lab as an exiled journalist and outspoken critic of the Abdel Fatah al-Sisi regime.
Cytrox did not immediately respond to a request for comment.
Internal scans by Citizen Lab found likely Predator customers in Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia.
Cytrox is reportedly part of Intellexa, the "Star Alliance" of spyware which was formed to compete with NSO and describes itself on its website as being EU-based and regulated. Intellexa did not respond to a request for comment.
An NSO spokesperson said it had not seen the Citizen Lab report but said the claims were "technologically and contractually illogical" because Egypt was on NSO's "no-sale" list and was not a customer and "will never be one".
"The use of cyber tools in order to monitor dissents, activists and journalists is a severe misuse of any technology and goes against the desired use of such critical tools. The international community should have zero tolerance policy towards such acts, therefore a global regulation needed. NSO has proven in the past it's zero-tolerance for these types of misuse, by terminating contracts," the spokesperson said.
Previous reporting by the Pegasus Project has shown that NSO has previously maintained certain customers, including the UAE, despite allegations of abuse. The company has indicated that it has cut ties with some clients, including Saudi Arabia and UAE following allegations of abuse.
Citizen Lab said Cytrox reportedly began as a North Macedonian startup and has a corporate presence in Israel and Hungary.
In its report, Facebook said it removed 300 accounts on Facebook and Instagram linked to Cytrox. It said investigations with Citizen Lab had found a "vast domain infrastructure" that it believed Cytrox used to spoof legitimate news entities in their countries of interest.
In its threat report, it described three stages clients of most of the companies it investigated use to target individuals. First, the reconnaissance stage, which involves "surveillance from a distance" to discern an individuals interests. Second is what Facebook calls an "engagement stage", in which companies' clients then establish contact with targets and seek to build trust and solicit information, and "trick them" into clicking on links and downloading files.
Finally, Facebook said the final move involves "hacking for hire", in which individuals are hacked or otherwise targeted by malware. The company said that it was important to focus and disrupt the first two stages of invasive surveillance, which have gotten less attention in media reports.
In the case of Black Cube, Facebook said it removed 300 Facebook and Instagram accounts linked to the company.
"Black Cube operated fictitious personas tailored for its targets: some of them posed as graduate students, NGO and human rights workers, and film and TV producers," Facebook said.
In a statement, Black Cube - which has apologised publicly for its work for Weinstein - said: "Black Cube does not undertake any phishing or hacking and does not operate in the cyber world. Black Cube is a litigation support firm which uses legal Humint investigation methods to obtain information for litigations and arbitrations. Black Cube works with the world's leading law firms in proving bribery, uncovering corruption, and recovering hundreds of millions in stolen assets. Black Cube obtains legal advice in every jurisdiction in which we operate in order to ensure that all our agents' activities are fully compliant with local laws."
Other entities banned by Facebook include: Cognyte, Bluehawk CI, BellTroX and what was described as an "unknown entity" in China, which it said was responsible for malicious targeting and appears to have been used for domestic law enforcement in China. The malware deployed by the group was used against minority groups in Xinjiang, Myanmar and Hong Kong.
BellTroX could not be reached for comment. A Cobwebs spokesperson told Reuters that the company drew on open sources and that its products "are not intrusive by any means".
The other entities named by Facebook did not respond to requests for comment.
