Cyberattackers used services of technology companies based in the U.S. and U.K. to target media sites from Somalia, Kosovo, and Turkmenistan, Qurium, a nonprofit hosting the sites, said Tuesday. Earlier this month, CPJ reported on how cyberattackers used a Nebraska company, RayoByte, in attempts to knock those same media sites offline, as well as at least three others in Nigeria, Kyrgyzstan, and the Philippines.
The findings provide new insight into how private companies are being used by malicious actors to try to suppress online reporting around the globe using distributed denial-of-service, or DDoS, attacks.
Qurium was able to defend against the attacks, but it still hasn’t found out who is behind them. “That’s the power of DDoS,” Qurium’s technical director, Tord Lundström, told CPJ’s Jonathan Rozen. “It never comes with a signature.”
The Committee to Protect Journalists is deeply disturbed by the findings of an investigation that the phone of exiled Russian journalist Galina Timchenko was infected by Pegasus surveillance spyware while she was in Germany earlier this year.
“Journalists and their sources are not free and safe if they are spied on,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator. “This attack on Timchenko underscores that governments must implement an immediate moratorium on the development, sale, and use of spyware technologies. The threat is simply too large to ignore.”
Timchenko’s phone was infected by Pegasus, a spyware produced by the Israeli company NSO Group, according to a Meduza report and a joint-investigation by rights groups Access Now and research organization Citizen Lab. The infection took place shortly after Russia’s Prosecutor General designated Meduza as an “undesirable” organization – a measure that banned the outlet from operating on Russian territory.
Read CPJ’s report on spyware’s threat to press freedom and the organization’s call for export controls on the technology.
We defend the right of journalists to report the news safely and without fear of reprisal.