It is part of their strategy to make you suspect you’re being watched so you feel like you’re under pressure all the time. Le Maroc et 44 autres pays sont les clients de NSO qui a créé Pegasus, un logiciel utilisé pour pirater des comptes WhatsApp. Moroccan HRDs have faced harassment, intimidation, and imprisonment. Read more about Israeli court backs notorious spy firm NSO Group . We believe this is what happened with Maati Monjib’s phone. We believe this is a symptom of a network injection attack generally called “man-in-the-middle” attack. That’s why contracts with all of our customers enable the use of our products solely for the legitimate purposes of preventing and investigating crime and terrorism. They are not tools to surveil dissidents or human rights activists. It was founded in 2010 by Niv Carmi, Omri Lavie, and Shalev Hulio. This was followed by the execution of a suspicious process and by a forced reboot of the phone. Additionally, a similar network injection capability was briefly described in a document named "Pegasus – Product Description" – apparently written by NSO Group – that was found in the 2015 leak of the competing Italian spyware vendor, Hacking Team. Constantly analysing what he should and shouldn’t say in his digital communications exerted significant psychological pressure on him. By inspecting Maati Monjib’s Safari browsing history we found visits to suspicious links that did not originate from SMS or WhatsApp messages. NSO Group Technologies est une entreprise israélienne de sécurité informatique fondée en 2010 par Niv Carmi, Omri Lavie, et Shalev Hulio [1].Elle est implantée à Herzelia en Israël et est constituée de deux cents employés. The full response from the NSO Group is included in Appendix-I, wherein they reiterate that allegations of misuse would be investigated. Safari records its entire browsing history in a SQLite database stored on the device (and exportable through an iTunes backup procedure). ]biz and infospress[. Amnesty International collected evidence of new abuses of the NSO Group ‘s surveillance spyware, this time the malware was used to spy two rights activists in Morocco. One message carrying a link with this domain showed the same characteristics as typical Pegasus SMS messages. Annual report 2019: Eastern Europe and Central Asia, EU Counter-Terrorism Agenda takes a wrecking ball to rights, Human rights monitoring needed more than ever in Western Sahara, documented the targeting of an Amnesty staff member and a Saudi HRD using NSO Group‘s Pegasus, malicious websites previously connected to NSO Group, previously identified and disclosed by Amnesty International, Hide and Seek: Tracking NSO Group‘s Spyware to Operations in 45 Countries, Amnesty International Among Targets of NSO-powered Campaign, Israel: Amnesty International engages in legal action to stop NSO Group’s web of surveillance, Open letter to Novalpina Capital, CC: NSO Group, Francisco Partners, Second open letter to Novalpina Capital, CC: NSO Group, Francisco Partners. We found that he was repeatedly targeted with malicious SMS messages that carried links to websites connected to NSO Group’s Pegasus spyware. Dans ce rapport, elle affirme toujours en employant le conditionnel que le téléphone de l’historien Maati Mounjib aurait fait … However, Morocco has denied these accusations claiming that it has never had a relationship with NSO Group, the company in charge of designing this type of software. If you are talented and passionate about human rights then Amnesty International wants to hear from you. These revelations are particularly significant in a context where Moroccan authorities are increasingly using repressive provisions from penal codes and security laws to criminalise and discredit human rights defenders and activists for exercising their rights to freedom of expression, association, and peaceful assembly. Refunds of donations. This report uncovers how this spyware was used to unlawfully target two prominent HRDs from Morocco, who have a history of facing reprisals from the state for speaking out openly about human rights in the country. NSO Group, entreprise israélienne commercialisant sa technologie pour combattre la pandémie de COVID-19, a favorisé une intense campagne menée par le Maroc pour espionner le journaliste marocain Omar Radi, a révélé Amnesty International dans un nouveau rapport d’enquête rendu public lundi 22 juin. ]co/nBBJBIP, فاجعة الصويرة تسقط أول المسؤولين أمام القضاء hxxps://infospress[. ]biz/2Kj2ik6, Le BackFriday continue exceptionnellement aujourd'hui chez CityClub!Dernière chance de s'offrir 15MOIS de fitness à 1633!\r\nDemain il sera trop tard 0522647000 STOPSMS: hxxps://stopsms[. He was charged under repressive penal provisions that criminalise the exercise of the right to free expression. Earlier this month, the NSO Group also released its Human Rights Policy. Further, Moroccan authorities should disclose the details of any deals carried out with the NSO Group and should ensure that HRDs are protected from unlawful surveillance through adequate legal and policy safeguards that are in line with international standards, including by providing effective legal remedies for people to challenge violations of their human rights linked to surveillance. NSO Group, the Israeli company marketing its technology in the fight against COVID-19, contributed to a sustained campaign by the government of Morocco to spy on Moroccan journalist Omar Radi, a new investigation by Amnesty International reveals. While analysing the iPhone of Maati Monjib, who we confirmed above was targeted with NSO Group’s Pegasus spyware using malicious SMS links, we observed some suspicious traces which we believe are indicative of some peculiar exploitation attempts. Espionnage : Le Maroc serait client de Circles, filiale de l'Israélien NSO Group. %PDF-1.6 %���� This is not the first time that spyware manufactured by the NSO Group has been used against HRDs. You can use this tool to change your cookie settings. Maati Monjib’s fears were proven to be true. We asked NSO Group to respond to the revelations detailed in their report. These messages, described as “Enhanced Social Engineering Message(s)“ (ESEM) in leaked NSO Group‘s documentation, attempt to lure victims to click on the contained link, which would then trigger an attempt of exploitation of the phone and the consequent silent installation of the Pegasus spyware on the device. Amnesty International said Sunday its security team found evidence of abuse on a Moroccan journalist’s cell phone that can be tied back to spyware developed by NSO Group. […] Soyez au Rendez-vous sur notre site :hxxp://tinyurl[.   |   (For a full list of all identified SMS messages, see Appendix-II. In addition to SMS messages, we identified what appear to be network injection attacks against a HRD’s mobile network also aimed at installing spyware. NSO Group has repeatedly said it only sells its technology to governments. endstream endobj startxref This may include suspending or immediately terminating a customer’s use of the product, as we have done in the past. Une fois ce postulat vide établi, il est devenu déterminant pour Amnesty de relier «NSO Group» au Maroc, malgré l’aveu préliminaire de cette ONG, sur le fait «qu’elle ne dispose d’aucune preuve sur l’achat, par Rabat, de cette technologie». Oct 10, 2019 | CYBERSCOOP Hackers potentially working on behalf of a foreign government have targeted Moroccan human rights advocates with malicious software built by NSO Group, a controversial spyware vendor, according to Amnesty International. h�bbd```b``^"W�Is��D2U�e���`R,�����d���o���`vX�j9g ��� �� WAl�P�� H�/�������g`����1�3@� DiZ The browser first attempted an unencrypted connection to http://yahoo.fr. Permissions Israel-based “Cyber Warfare” vendor NSO Group produces and sells a mobile phone spyware suite called Pegasus. ]com/y7wdcd8z, Urgent le livre sur Donald Trump s est arrache dans toutes les librairies une version arabe est disponible gratuitement sur le lien hxxp://tinyurl[.]com/y87hnl3o. The messages containing malicious links were sent to him during what he recalls was the peak of the Hirak El-Rif movement and the subsequent repression by the Moroccan security forces. Omar Radi is the latest journalist to have his phone compromised by NSO Group. Dans un nouveau rapport publié le 22 juin, nous révélons que l’entreprise israélienne, NSO Group, qui commercialise sa technologie pour combattre la pandémie de COVID-19, a favorisé une intense campagne menée par le Maroc pour espionner le journaliste marocain Omar Radi. In June 2018 Amnesty International documented the targeting of an Amnesty staff member and a Saudi HRD using NSO Group‘s Pegasus. In addition to it being used to target an Amnesty staff member in 2018, NSO group’s software has also been used to attack HRDs from Saudi Arabia, Mexico and UAE. Through this, an attacker with privileged access to a target’s network connection can monitor and opportunistically hijack traffic, such as web requests. The targeting of Maati Monjib and Abdessadak El Bouchattaoui, simply for carrying out human rights work, is unlawful according to principles laid out in international human rights law. Aux côté de 24 pays au monde, le Maroc a été cité comme client potentiel pour les produits de l’entreprise Circles, filiale de le la société israélienne NSO, dans une nouvelle 446 0 obj <>stream If an investigation identifies actual or potential adverse impacts on human rights we are proactive and quick to take the appropriate action to address them. During the course of his trial he received death threats and his family was intimidated over the phone. Another domain we found in SMS messages sent to Moroccan HRDs, revolution-news[. Our products are developed to help the intelligence and law enforcement community save lives. This even applies to very practical things like arranging meetings or a dinner downtown. Amnesty International met Maati Monjib and checked his devices for traces of targeting. Le rapport d’Amnesty International sur les activités de NSO Group en relation avec le Maroc, complètent en réalité toute une série d’actions entreprises ces 5 dernières années par l’organisation de Droits de l’Homme dans un bras de fer avec l’entreprise israélienne spécialisée dans les logiciels de surveillance. The organization found that Radi's phone was subjected to several attacks using a "sophisticated new technique" that silently installed NSO's Pegasus spyware. Citizen Lab survey lists Morocco as customer of Circles, a subsidiary of Israel’s NSO Group. We have placed cookies on your device to help make this website better. The NSO Group says that it licenses products “only to government intelligence and law enforcement agencies” to investigate serious crime. This has had a detrimental impact on his activism and daily life. We confirmed Maati Monjib had already been targeted with NSO Group’s Pegasus spyware via malicious SMS messages. Espionnage: le Royaume du Maroc serait un client de Circles, filiale de l’Israélien NSO Group Aux côté de 24 pays au monde, le Maroc a été cité comme client potentiel pour les produits de l’entreprise Circles, filiale de le la société israélienne NSO, dans une nouvelle … Amnesty International is calling on the Moroccan authorities to quash the conviction against him. Additionally, we identified a new previously unknown domain: hmizat[. I need to constantly analyze the consequences of what I say and the risk that this may lead to defamatory accusations against me. The NSO Group claims that the technology is only used for lawful purposes, such as against terrorists and criminals and that if states misuse its tools, its human rights due diligence mechanisms are sufficient to investigate and remedy that misuse. If you received similar SMS messages to those described in this report, you can share them with us by writing to the following email address: “As per our policy, we investigate reports of alleged misuse of our products. NSO Group Technologies (NSO standing for Niv, Shalev and Omri, the names of the company's founders) is an Israeli technology firm whose spyware called Pegasus enables the remote surveillance of smartphones. If we ever discover that our products were misused in breach of such a contract, we will take appropriate action.”, Nouveau à temara La 1 ère fois à Bd Fouarate Apparts avec jardin ,grandes piscines & Salle sport + 2 piscines chauffées 7/7 6000/m2. Privacy Policy The links contained in such messages closely resemble the URLs involved in the network injection attacks: Both links are composed of rather generic domain names, followed by a 7-9 random alphanumeric string. (I?�6�M�q�Q����\�7000vtt0d0H4�50yt0x0� I&� CF3�#�R� "#�:;:%:�:��1c�8��E�X Maureen Clare Murphy 17 April 2020. To monitor a target, a government operator of Pegasus must convince the target to click on a specially crafted exploit link, which, when clicked, delivers a chain of zero-day exploits to penetrate security features on the phone and installs Pegasus without the user’s knowledge or permission. Since the middle of 2018, he has been living in France after his request for asylum was accepted. 408 0 obj <> endobj ]co, was previously identified by Citizen Lab in the report “Hide and Seek: Tracking NSO Group‘s Spyware to Operations in 45 Countries“ as associated to the threat actor they named “ATLAS“ and suspected by Citizen Lab to be of Moroccan origin. This means that only select individuals would have been targeted. NSO Group licences have failed in their responsibility to protect human rights by not adequately scrutinising and failing to deny export authorization where there is a substantial risk that the export in question could be used to violate human rights. In this case, the attackers cleverly crafted the attack to appear like a flood of automated spam SMS messages with the same text, and offering the malicious link as a way to stop receiving them. According to our research, these targeted attacks have been ongoing since at least 2017. Amnesty International has discovered that since at least October 2017, HRDs from Morocco have been targeted with the infamous “Pegasus“ spyware produced by the Israeli company ‘NSO Group’. June 22, 2020 By Pierluigi Paganini Researchers at Amnesty International collected evidence that a Moroccan journalist was targeted with network injection attacks using NSO Group ‘s spyware. ]com, have been previously identified and disclosed by Amnesty International as part of NSO Group‘s exploitation infrastructure. ]biz/yTnWt1Ct, ALQODS RESTERA TOUJOURS LA CAPITALE DE LA PALESTINE SAUVEZ LA VILLE SAINTE EN SIGNANT CETTE PETITION hxxp://tinyurl[. 431 0 obj <>/Filter/FlateDecode/ID[<00C540067418FF46B53C963391A56DB3>]/Index[408 39]/Info 407 0 R/Length 111/Prev 638556/Root 409 0 R/Size 447/Type/XRef/W[1 3 1]>>stream In 2015, Moroccan authorities accused him (and four others) of “threatening the internal security of the state” through “propaganda” that may threaten “the loyalty that citizens owe to the State and institutions of the Moroccan people” under Article 206 of the Penal Code, according to official court papers. En octobre 2019, Amnesty International a publié un premier rapport sur l’utilisation d’un logiciel espion produit par l’entreprise israélienne NSO Group en vue de cibler des défenseurs des droits humains marocains, Maati Monjib et Abdessadak El Bouchattaoui. Amnesty International urges the NSO Group to conduct a transparent investigation and awaits concrete action that adequately addresses the concerns raised in this report. Such a network vantage point could be any network hop as close as possible to the targeted device. Résumé. These suspicions are now definitively confirmed. ), (Please note: throughout this text domain names and links are escaped, for example using “[. He is a part of the legal defence team for people imprisoned for participating in the social justice protests in the Hirak El-Rif across 2016 and 2017. When people are targeted for surveillance based only on the exercise of their human rights, it would amount to an “arbitrary or unlawful” attack on their privacy and hence, would violate their freedom of expression that is enshrined in the International Covenant on Civil and Political Rights. Der Name NSO GmbH (Netzwerk Systemadministration und Onlineservices) hat uns über 16 Jahre treu begleitet. ]com/LQoHgMCEE, Bonjour,Quelqu'un vous a recherché sur Truecaller.Découvrez de qui il s'agit. This charge was leveled simply for promoting a mobile application for citizen journalism that protected users’ privacy. The link between Warner and Omri Lavie, an ex-Israeli intelligence officer and one of the three founders of NSO Group (NSO stands for Niv, Shalev, and Omri, the first names of the three founders) lies in Warner’s longtime confidant, current business partner, and the former manager of his family’s investment office, Nicholas Perrins. 0522647000 STOPSMS: hxxps://stopsms[. In October 2019, in response to our report that NSO Group’s tools were used to unlawfully target HRDs in Morocco, NSO Group told Amnesty International in a letter: “Our products are developed to help the intelligence and law enforcement community save lives. die NSO GmbH wurde in die feelgood-IT GmbH >> https://www.feelgood-it.de << umbenannt. ]” instead of dots or “hxxp” instead of “http”, in order to avoid accidental clicks or copy & paste.). Amnesty International has uncovered targeted digital attacks against two prominent Moroccan Human Rights Defenders (HRDs) using NSO Group’s Pegasus spyware. He says that he has been followed multiple times and that his clients have also been harassed. Amnesty International wrote to the NSO Group and Novalpina Capital to seek their response on the information detailed in this report. NSO Group’s Pegasus tool is used for targeted attacks and by design, is not meant for mass surveillance. NSO Group spyware used against Moroccan journalist after company pledged to respect human rights; Inc. Co. comments. NSO Group publicly committed to abide by the UN Guiding Principles on Business and Human Rights on 10 September. With network injection spyware attacks, the attacker requires either physical proximity to the targets or access over national mobile networks (which only a government can authorise), further indicating that the Moroccan authorities were responsible for the attack against Radi. Pour ne plus recevois nos SMS : hxxp://stopsms[. Previously, he had protested restrictions on his movements by going on a hunger strike. NSO Group, entreprise israélienne commercialisant sa technologie pour combattre la pandémie de COVID-19, a favorisé une intense campagne menée par le Maroc pour espionner le journaliste marocain Omar Radi, a révélé Amnesty International dans un nouveau rapport d’enquête rendu public lundi 22 juin. ]biz/TY8us0h, TruecaIIer à le plaisir de vous annoncer l'ajout d'une nouvelle fonctionnalité, consulter les noms des personnes qui ont cherché votre numéro durant une semaine hxxp://tinyurl[. After about 30 seconds, Maati Monjib again tried to access Yahoo, this time by searching “yahoo.fr mail“ on Google and then eventually being directed to the right location where he then read his email. Abdessadak El Bouchattaoui, is a lawyer and HRD. Interestingly, some of the malicious links started with a capital “Https://” instead of “http://” and in one case the link missed a character, which suggests the attackers might have been typing SMS messages manually, and then sending them from a Moroccan number. However considering the technical similarities to other Pegasus infections, the fact that Monjib has already been targeted with NSO Group’s software and the fact that NSO Group advertise the network injection capability we suspect was used in this attack, there is reason to believe that NSO Group’s tools may also have been used in this attack. Un rapport documenté de Citizen Lab affirme que le Maroc, à travers ses instances sécuritaires, fait partie des Etats clients de Circles Systems, une filiale de la firme israélienne NSO Group qui commercialise des technologies de surveillance controversées. The targeting of Radi came at a time when he was being repeatedly harassed by the Moroccan government between January 2019 and January 2020. This is increasingly making it difficult for HRDs and activists to exercise their rights to freedom of expression and association, and peaceful assembly. Further analysis of the device led us to identify at least four similar injection attempts between March and July 2019. La société a débuté financée par un groupe d'investisseurs menés par Eddy Shalev, un partenaire dans le fonds d'investissement Genesis Partners. ]com/y73qr7mb, فضيحة أخلاقية داخل مقهى بورتز في حي أكدال بالرباط \r\nلمشاهدة الفيديو الذي يوثق الفضيحة hxxps://videosdownload[.   |   Read more about Morocco used Israeli malware to spy on journalists . This visit was followed by a redirect to the same domain, but provided with additional arguments: hxxps://bun54l2b67.get1tn0w.free247downloads[.]com:30495/szev4hz#048634787343287485982474853012724998054718494423286. In order to meet that responsibility, NSO Group must carry out adequate human rights due diligence and take steps to ensure that HRDs in Morocco do not continue to become targets of unlawful surveillance. Il est dit que les fondateurs sont des anciens membres de l'unité 8200, l'unité de renseignement israélienne responsable du Renseignement d'origine électromagnétique4.   |   This affected his sense of psychological well-being and made it difficult for him to carry out his work. SMS messages delivered to them carried links that pointed to malicious websites previously connected to NSO Group. In February 2017, a court in Al Hoceima sentenced him to 20 months in prison and a fine for online posts in which he criticized the use of excessive force by the authorities during the protests. Otherwise, we'll assume you're OK to continue. Abdessadak El Bouchattaoui had also long suspected that his digital communications were being monitored. On July 22nd Maati Monjib opened Safari and tried to visit Yahoo by manually typing “yahoo.fr“ in the address bar. Technology developed by Israeli cyber security company NSO Group was used by the Moroccan government to spy on journalist Omar Radi, a critic of Morocco's human rights record, Amnesty International said on Monday. ]com/y9hbdqm5 \nvous pouvez consulter nos offres du moment, Vous l'avez demandé,CityClub l'a fait!Grand retour du BLACKFRIDAY vendredi 24/11!\r\nRéservez votre carte promo 15 mois à 1633dh! We believe at least one injection attack was successful and resulted in the compromise of Maati Monjib’s iPhone. This type of redirection would only be possible when the request is in clear text, and not protected with Transport Layer Security (or TLS, which is essentially the https:// you sometimes see in links), as was the case with http://yahoo.fr. This month, Amnesty International identified two Moroccan activists targeted by attempts to install Pegasus since at least October 2017. Radi was targeted by a series of network injection attacks, which allowed attackers to intercept and manipulate targets’ internet traffic, Amnesty International said. They can be found in Settings > Privacy > Analytics > Analytics Data. Currently, we do not have sufficient information to conclusively attribute these suspected network injection attacks to NSO Group’s products or services.