Seven companies that make spyware have been removed from Facebook, which blocked their Internet, sending them cease and desist letters and banning them from its platform.
See also: Facebook veteran: "Individual people" are responsible for misinformation
“As a result of our months-long investigation, we took action against seven different surveillance-for-hire entities to disrupt their ability to use their digital infrastructure to abuse social media platforms and enable the tracking of people online,” said Director of Threat Disruption, David Agranovich , and Head of Cyber Espionage Investigations, Mike Dvilyanski .
«These surveillance providers are based in China, Israel, India, and North Macedonia. They target individuals in over 100 countries around the world on behalf of their clients.»
Following this investigation, Facebook found that the services of these seven companies were used against vulnerable individuals such as activists, journalists, and minorities, resulting in harm to them.
However, the surveillance companies argued that spyware and tools were only used to target and help catch criminals and terrorists.
See also: PhoneSpy: Android spyware campaign targets Korean users
Facebook notified the people targeted by its surveillance tools, about 50,000 users, and shared its findings with other platforms, security researchers, and policymakers to take appropriate action.
According to the full report published by Facebook, the seven surveillance-for-hire entities whose activity was suspended as a result of Facebook's investigation and the specific stages of surveillance they specialize in are:
- Cobwebs Technologies (recognition, engagement)
- Cognyte (recognition, engagement)
- Black Cube (recognition, engagement, exploitation)
- Bluehawk CI (identification, engagement, exploitation)
- BellTroX (identification, engagement, exploitation)
- Cytrox (mainly exploitation)
- An unknown entity in China (mainly reconnaissance, exploitation)
See also: FakeCop spyware spreads as antivirus in Japan
"Although public debate has focused primarily on the exploitation phase, it is critical to disrupt the entire attack lifecycle, as earlier stages enable later ones," they added.
«If we can collectively address this threat earlier in the surveillance chain, it would help stop the damage before it reaches the final, more serious stage of infecting people's devices and accounts».
