Amazon Shuts Down Infra and Accounts Linked to “Israel’s NSO Group”

• 

Amazon Web Services (AWS), which offers paid cloud computing services, has shut down infrastructure and accounts linked to the Israeli spyware firm NSO Group, according to what Amazon spokesperson confirmed to the French newspaper “Le Monde”.

“When we learned of this activity, we acted quickly to shut down the relevant infrastructure and accounts,” he said.

Furthermore, Amnesty revealed that a phone belonging to a French rights lawyer, which was infected with the Pegasus spyware, sent information on the device "to a service fronted by Amazon CloudFront, suggesting NSO Group has switched to using AWS services in recent months."

The spyware infiltrates through "zero-click exploits" using the iMessage app on phones running on the Apple software iOS, according to the same report.

"Amnesty International suspects the shutting down of the V4 infrastructure coincided with NSO Group’s shift to using cloud services such as Amazon CloudFront to deliver the earlier stages of their attacks. The use of cloud services protects NSO Group from some Internet scanning techniques."

"Amnesty has found that Amazon hosts up to 73 servers on its network."

Amnesty International noted that after reporting a distinct pattern of spyware attacks in 2020 and 2021 to Amazon, the latter informed them that they "acted quickly to shut down the implicated infrastructure and accounts."

Amazon’s Adequate Action

Amazon's move is the first practical step taken by a global body in response to the "Pegasus" scandal. It is expected that the move will reverberate in other circles, which may see the extensive espionage operation led by the Israeli company as a violation of human rights, particularly the right to privacy.

Furthermore, social media companies such as WhatsApp, which have been directly targeted by the program, are expected to be at the forefront.

What is AWS?

Amazon Web Services (AWS) is an Amazon subsidiary that offers on-demand cloud computing platforms and APIs to individuals, businesses, and governments on a pay-as-you-go basis.

With millions of active customers and tens of thousands of partners worldwide, AWS has one of the largest communities. Customers from every industry and size, including startups, enterprises, and public sector organizations, buy its services.

For several years, AWS has provided its services to the Israeli digital monitoring company "NSO Group," which works in full coordination with the Israeli occupation government.

The Pegasus Project

According to an investigation led by "The Washington Post" and 16 media partners, military-grade spyware leased by the Israeli firm NSO Group to governments was used in attempted and successful hacks of 37 smartphones belonging to journalists, human rights activists, business executives, and the two women closest to the murdered Saudi journalist Jamal Khashoggi.

Forbidden Stories, a Paris-based media foundation, and Amnesty International, a human rights organization, had access to a list of over 50,000 phone numbers, which they provided to news media for additional investigation and analysis. The phones were forensically examined by Amnesty International's Security Lab.

The investigation discovered that 37 targeted smartphones were found on a list of more than 50,000 numbers concentrated in countries known to engage in citizen surveillance and also known to have been clients of NSO Group, a top Israeli firm in the growing and largely unregulated private spyware industry.

The numbers on the list are unattributed, but via research and interviews on four continents, reporters were able to identify more than 1,000 people from more than 50 countries. Several members of the Arab royal families, at least 65 corporate leaders, 85 human rights activists, 189 journalists, and over 600 politicians and government officials, including cabinet ministers, ambassadors, and military officers, have all been targeted.