IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Bahrain targets activists with NSO's Pegasus spyware

The spyware reportedly employed two exploits targeting Apple's iMessage system

The government of Bahrain has once again used spyware from Israeli surveillance company NSO to target activists' smartphones, according to a Citizen Lab report,

The spyware employed two exploits targeting Apple's iMessage system, including a new one first spotted in June. 

The report tracked the targeting of nine Bahraini activists using the NSO software. The investigation ties the infection servers to NSO's Pegasus spyware, and tracked the spyware's use of multiple vulnerabilities in iMessage. 

Citizen Lab researchers noted that a Bahrain government operator codenamed LULU compromised iPhones using Pegasus via a zero-click iMessage exploit known as KISMET between July and September 2020. This simply required the phone to receive a message, enabling the spyware to compromise the operating system and monitor its internet traffic. 

KISMET compromised iOS versions until at least version 13.7, according to the Citizen Lab. At that point, Apple updated iOS with the BlastDoor security feature that defended against zero-click iMessage attacks. NSO's Pegasus spyware then resorted to a single-click attack, requiring victims to follow a link in an iMessage. 

Pegasus returned to zero-click attacks from February 2021 with a more recent exploit Citizen Lab called FORCEDENTRY. 

Related Resource

Challenging the rules of security

Protecting data and simplifying IT management with Chrome OS

Whitepaper front coverFree download

FORCEDENTRY appears to be the same as Megalodon, an attack Amnesty International identified in June. It is a zero-click attack that could compromise phones without any user interaction. Amnesty confirmed it had compromised iPhones running iOS 14.6 in June, and Apple told the organization it was investigating the issue. At the time of writing, the latest version of iOS is 14.7. 

Freedom House, a non-profit that promotes democracy worldwide, classified Bahrain as “Not Free,” and gives it a freedom score of 29% due to heavy restrictions on internet use and strong censorship practices. The country arrests internet users for discussing forbidden topics online and engages in online surveillance practices, including spyware. 

Citizen Lab first documented Bahrain Pegasus use in 2018 via a government operator that it called PEARL. It posited that LULU may be the same state surveillance team. 

NSO continues to face challenges as it sells spyware to countries with oppressive histories, including Bahrain. Amazon Web Services shut down NSO infrastructure running on its servers last month, and United Nations human rights experts renewed calls for an international moratorium on the sale of spyware. 

The Citizen Lab cited tools from other companies the Bahrain government used for online surveillance, including Cellebrite, FinFisher, Netsweeper, Trovicor, and Verint. 

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
RATDispenser evades nine in ten anti-virus engines
Security

RATDispenser evades nine in ten anti-virus engines

24 Nov 2021
Hackers use Linux backdoor on compromised e-commerce sites with software skimmer
malware

Hackers use Linux backdoor on compromised e-commerce sites with software skimmer

19 Nov 2021
Iranian hackers ramp up attacks against IT services sector
hacking

Iranian hackers ramp up attacks against IT services sector

19 Nov 2021

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022