Cyprus denies link to spyware infections inside UK government (updated)

Cyprus authorities “categorically deny” any involvement in the alleged hacking of the British foreign ministry after a digital rights watchdog named it as one of the three countries from which Pegasus operators were linked to.

Citizen Lab said in its report that the spy software known as Pegasus, a product of Israeli cyber arms dealer NSO Group, had infected both the Downing Street and Foreign Office with Israeli-made spy software.

The watchdog believes the targeting connected to the British foreign ministry hacking came from countries including Cyprus, Jordan and India, while the attack on the prime minister’s office was done by NSO clients in the United Arab Emirates.

Government spokesperson Marios Pelekanos told Reuters that Cyprus categorically denies any involvement in the matter and has never been approached with any sort of inquiry on the subject at large by the relevant British authorities, it was reported on Tuesday.

“We note that the government of the Republic of Cyprus… enjoys excellent relations with the British government in all fields,” he added.

Pegasus can be used to remotely break into iPhones, giving clients deep access into a targeted phone’s memory or turning them into recording devices.

In questions to the European Commission posed by MEPs in July 2021, it was stated that the NSO Group also exports its products from Bulgaria and Cyprus.

Last year, the US placed NSO on a US blacklist – saying it had evidence of the company selling surveillance spyware to foreign governments that had been used for “transnational repression”.

According to a May 2019 Financial Times report NSO showcased its wares to Saudis at a conference room at the Four Seasons in Limassol in mid-2017.

After the demonstration “they were still discussing pricing, when the Saudis said they wanted it immediately,” the FT quoted a businessman present at the conference. The businessman claims the Saudi government paid $55m for the ability to track 150 targets simultaneously.

According to a lawsuit in Israel, the technology worked by sending an “enticing” message to the victims which they were likely to click on and their devices would then become infected.

The FT reported the businessman as saying that these messages were created by customers collaborating with NSO and described a help desk based in Cyprus that worked with agencies.

As for the latest Citizen Lab report, an NSO spokesperson said the allegations are “false and could not be related to NSO products for technological and contractual reasons”.

A British government spokesperson said: “we do not routinely comment on security matters”.

Citizen Lab found evidence of the compromised UK devices by monitoring internet traffic and other digital signals to spy servers that control Pegasus for various NSO clients.

“We identified infections emanating from those UK networks based on a variety of network scanning methods we use, and notified the relevant UK authorities of our suspicions at the time for them to follow up,” Citizen Lab Director Ron Deibert wrote in a blog post.

“We did not have access to any devices, and do not have any information on specific victims.”

Citizen Lab is known as one of the leading research groups on mercenary spyware within the cybersecurity industry.

The hacking activity connected to the British prime minister’s office was investigated by the UK National Cyber Security Centre, where technicians tested multiple phones to find malware, according to a New Yorker article about NSO Group also published on Monday, but the findings were inconclusive.