Hack-for-Hire Group Exposed: Targeting Journalists, Activists, and Officials Across the Middle East and North Africa

Security researchers have identified a hack-for-hire group targeting journalists, activists, and government officials across the Middle East and North Africa. The hackers used phishing attacks to access targets’ iCloud backups and messaging accounts on Signal, and deployed Android spyware capable of taking over the targets’ devices.

According to researchers from the digital rights organization Access Now, the hackers behind this campaign work for a hack-for-hire vendor codenamed BITTER, which they suspect has ties to the Indian government.

In an interview with TechCrunch, Justin Albrecht, principal researcher at Lookout, said that the company behind BITTER may be called RebSec Solutions, and could be an offshoot of the Indian hack-for-hire startup Appin. In 2022 and 2023, Reuters published extensive investigations into Appin and other similar India-based companies, which exposed how these companies are allegedly hired to hack company executives, politicians, military officials, and others.

Techniques Used by the Hackers

When targeting iPhone users, the hackers tried to trick targets into giving up their Apple ID credentials in order to then hack into their iCloud backups, which effectively would have given them access to the full content of the targets’ iPhones. This is “potentially a cheaper alternative to the use of more sophisticated and expensive iOS spyware,” according to Access Now.

When targeting Android users, the hackers used a spyware called ProSpy, masquerading as popular messaging and communications apps like Signal, WhatsApp, and Zoom, as well as ToTok and Botim, two apps that are popular in the Middle East. In some cases, the hackers tried to trick victims into registering and adding a new device — controlled by the hackers — to their Signal account, a technique that has been popular among various hacking groups, including Russian spies.

Growing Trend of Government Agencies Outsourcing Hacking Operations

These groups and their customers get “plausible deniability since they run all the operations and infrastructure,” Albrecht said. And for their customers, these hack-for-hire groups are likely cheaper than purchasing commercial spyware, said Albrecht.

Contact Information

If you have more information about RedSec Solutions or other hack-for-hire companies, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.