More than 30 Thai activists and supporters have been hacked with powerful spyware Pegasus of NSO Group, civic organizations said late Sunday, in the first campaign across the country to come to light because the Apple warned targeted iPhone users.
Η Apple issued warnings to suspected Pegasus victims in November, prompting some of the Thai recipients to contact civic organizations that subsequently consulted the iLaw, a local human rights group that supported a new constitution drafted by elected representatives. iLaw then helped identify more victims.
The iLaw issued one of the new reports, identifying several of the hacking victims by name, including two of its own participants. Another report came from Citizen Lab based in Toronto, which analysed digital traces left on phones and named Pegasus as the attack program that invaded devices in 2020 and 2021. The Amnesty International used a different method to test some of the phones and agreed with Citizen Lab's conclusions.
While he was not shocked that he had been hacked, the iLaw spokesman, Yingcheep Atchanont, told the Washington Post, "I was surprised later to find out that I had been hacked so many times in late 2020 and early 2021. At the time, I was just an observer of the protests; my role is simply to campaign for the constitutional amendment."
See also: Hackers target journalists and media organisations
The NSO Group based in Israel was blacklisted from deals with US companies after a wave of revelations that Pegasus spyware had been used against peaceful dissidents and their associates around the world, including those close to the murdered Saudi journalist Jamal Khashoggi, and to the officials of the State Department.
New reports indicate that many attacks occurred at a time when the targets were participating in rallies against government policies. While not claiming that the Thai government was responsible, one or more Thai agencies would be more reasonable suspects than those in neighboring companies, said the Citizen Lab.
Thailand's government won widely criticised elections in 2019 after a previous coup that destroyed freedoms. Since then, it has arrested several protest organizers, including some listed as victims of hacking by Pegasus in the new reports.
Some have been charged under sweeping laws that make it illegal to criticise the king, who lives mostly in Germany. Others have been accused of violating emergency decrees banning certain negative media reports and of large gatherings after demonstrations that drew tens of thousands of people.
The NSO says it sells only to government agencies and receives Israeli approval for its deals. The Thai government, which has wide latitude to spy on citizens under recent laws, has previously denied hacking activists. The NSO's CEO did not respond to an email Sunday morning and an email sent to the Thai Embassy in Washington also received no immediate response.
The company has served as the latest symbol for one of the world's most complex challenges, how to stop governments from hiring top engineering talent to exploit software vulnerabilities and spy on whoever they want.
Η Apple and Facebook's parent company, Facebook Meta, have filed lawsuits accusing the NSO of violating US laws by hacking their equipment.
In a recent update, Apple said it has sent warnings to an unknown number of government hacking targets in 150 countries. It also announced that it will release an optional lockdown mode intended to make its phones, tablets and computers safer by reducing some of the convenient features, such as downloading attachments to iMessage and automatic preview of web links, that also make it possible to install spyware with user notification.
Previous reports had identified Thailand as a location for surveillance operations, including Pegasus.
However, the new reports go further by identifying victims and providing context for specific attacks.
"The attacks occurred from October 2020 to November 2021, coinciding with a period of widespread pro-democracy demonstrations and primarily targeting key figures in the pro-democracy movement," the Citizen Lab, which is affiliated with the University of Toronto. "In many cases, many members of movements or organizations were infected."
See also: Pedro Sánchez: Pegasus spyware detected on the phone of the Prime Minister of Spain
Pegasus is a monitoring system that can record audio, images, texts, texts, contacts, emails and all messages on a phone, including those that are strongly encrypted. It can be installed with any "exploit" or attack program that works on a particular model Android ή iPhone. The most effective exploits do not require the phone owner to click on anything to be installed silently. Typically, as soon as Apple or another vendor detects an infection or fixes the vulnerability that was used, the NSO creates another exploit.
The Thais hit by Pegasus include five members and associates of FreeYouth, including the former President of the Student Union of Thailand, Jutatip Sirikhan, four members of the WEVO, short for We Volunteer, which protects other groups during public actions and four members of the United Front of Thammasat and Demonstration based at the University of Bangkok.
The human rights lawyer Arnon Nampa, who defended activists accused of violating the law against insulting the king, was repeatedly infected, including once when he was in jail without his phone.
Also, according to reports, the Thai actress Intira Charoenpura, who publicly supported the protests and asked for donations and the rapper Dechathorn Bamrungmuang, who blamed the government in a song. Known on stage as Hockhacker, his single "My Country Has" has garnered more than 100 million views on YouTube.
Source: washingtonpost.com
