Facebook has sued the Israel-based cyber intelligence company NSO Group for violating the Computer Fraud and Abuse Act. According to the lawsuit filed in the federal court, the NSO Group deployed its custom malware on around 1,400 WhatsApp installed mobile devices in April and May 2019.
NSO Group is a developer of spyware for mobile devices. The firm is known for the development of Pegasus software that targets mobile phones to gather information and provides authorized governments with technology that helps them combat terror and crime.
In May WhatsApp, a Facebook-owned instant messaging app, revealed that it discovered a vulnerability in its network system that allowed hackers to install spyware via an infected WhatsApp voice call. It stated that the spyware can exploit the mobile device, its calls, and texts; it activates the phone’s camera, microphone, and it is able to perform other malicious activities. The malicious spyware was developed by the NSO Group, according to Facebook.
Now, after its investigation, Facebook revealed that the attack was linked to the NSO Group. It stated the attackers used servers and Internet-hosting services that related to NSO. According to WhatsApp’s findings, nearly a hundred human rights advocates, journalists, and members of civil society across the world were targeted in the attack.
“Between and around April 2019 and May 2019, Defendants used WhatsApp servers, located in the United States and elsewhere, to send malware to approximately 1,400 mobile phones and devices. Defendants’ malware was designed to infect the Target Devices for the purpose of conducting surveillance of specific WhatsApp users. Unable to break WhatsApp’s end-to-end encryption, Defendants developed their malware in order to access messages and other communications after they were decrypted on Target Devices. Defendants’ actions were not authorized by the Plaintiffs and were in violation of WhatsApp’s Terms of Service. In May 2019, the Plaintiffs detected and stopped Defendants’ unauthorized access and abuse of the WhatsApp Service and computers,” a statement from the lawsuit read.
