Israel’s spyware industry, pioneer in global cyber crimes

At first glance, the Israeli startup Cobwebs Technologies seems like just another cybercompany. On its website, the firm proudly declares that it’s “a world leader in web intelligence.” In 2019, when it announced that it had raised $10 million, the company claimed to have developed a search engine for intelligence information and said it wanted to be the “Google for intelligence.”

Early in the coronavirus crisis, Cobwebs announced that it had developed a product that would predict the spread of the pandemic, and even boasted that it was working with the Defense Ministry’s Administration for the Development of Weapons and Technological Infrastructure.

But the report released Thursday by Meta, Facebook’s parent company, exposes a more secretive element of the company’s activities. The report describes Cobwebs, three other Israeli companies and three outfits from India, China and North Macedonia as “cyber mercenaries.”

According to Meta, Cobwebs activates counterfeit accounts for its clients that conduct surveillance online, including on social networks such as Facebook, Instagram, WhatsApp and Twitter. For example, the clients can collect information on activists, politicians and government officials around the world.

The counterfeit accounts also join communities and forums, tricking people to reveal personal data and later hacking the targets’ phones or computers. Cobwebs has clients in the United States but also in Bangladesh, Saudi Arabia and elsewhere.

Meta’s report was anything but circumspect. It named the Israeli companies Cobwebs, Cognyte, Bluehawk and Black Cube, as well as North Macedonia’s Cytrox (which is apparently Israeli-owned), India-based firm BellTroX and “an unknown entity in China.” They are described as belonging to a “global surveillance-for-hire industry” whose methods are similar to that of the Israeli company NSO Group Technologies.

“Given the severity of their violations, we have banned them from our services,” Meta writes. “We also alerted around 50,000 people who we believe were targeted by these malicious activities worldwide, using the alert system we launched in 2015. We recently updated it to provide people with more granular details about the types of targeting and the actor behind it so they can take steps to protect their accounts, depending on the phase of the surveillance attack chain we detect in each case.”

For the most part, the cybersecurity industry operates under the radar. While most companies don’t specialize in sophisticated hacking tools like NSO, the targets and methods are similar. These companies make sure they operate in a legally gray area and consider themselves legitimate intelligence-gathering firms.

Indeed, intelligence collection by countries and companies is done as a matter of course. Though some of the firms say their tools help fight terror or crime, Facebook is shining a spotlight on, for example, the hacking of devices of journalists, human rights activists and regime opponents in some 100 countries, including non-democracies.

In the report, Meta doesn’t discuss the clients’ motives, but these might include companies’ collecting intelligence on competitors, regimes surveilling their opponents, and people or organizations gathering intelligence for extortion or legal claims. “Find some dirt on him for me,” CEOs and politicians around the world might tell their people – who then contact the Israeli spyware purveyors.

Meta’s report is rare; the company hardly ever gets down to this level of detail. The cybersecurity companies gather intelligence by exploiting the platforms owned by Meta – WhatsApp, Facebook and Instagram. This lets Meta’s investigators identify the targets, clients and method of operation.

In the first stage, the counterfeit account makes contact with the target and persuades him or her to carry on a conversation and provide information such as contact details or passwords.

In the second stage, surveillance software is implanted in the target’s phone or computer; it can be a sophisticated cyberwarfare tool or merely an off-the-shelf product. Either way, it allows full surveillance of one’s digital life. The Israeli companies named by Meta either performed some or both of these stages.

Besides Cobwebs, Meta also named Cognyte, the firm headed by Elad Sharon that was spun off from Israeli company Verint in 2019. According to the report, Cognyte sells tools to manage counterfeit accounts on social media sites from Facebook to YouTube to Russia’s Vkontakte. The tools, Meta says, allow clients “to social-engineer people and collect data.”

In other words, they get the victim to, for example, reveal sensitive details or click on a malicious link. Cognyte’s clients are located in countries including Israel, Colombia, Kenya, Morocco, Jordan and Indonesia. Among the targets: journalists and politicians.

Black Cube, a corporate intelligence company headed by Dan Zorella, is already familiar with controversy. According to Meta, the company enables clients to pose as other people and acquire a person’s email address for the purpose of phishing attacks.

Targets have been identified in the medical industry, mining, energy and among nonprofit groups. Other targets have included Palestinian activists, people in the Russian media, and experts in academia, high tech and finance.

Bluehawk, headed by Guy Klisman, an alumnus of Israeli Military Intelligence’s research division, provides spyware options including the collecting of legal information and the management of counterfeit accounts designed to persuade people to install malware. One common practice is to pose as a journalist. Victims have included Emirati and Qatari politicians and businesspeople.

The article was first published in Haaretz.