{ "id": "88f845db-9ced-412e-8eaa-f17e8a3f25f5", "created_at": "2026-04-06T00:09:56.842667Z", "updated_at": "2026-04-10T03:35:28.855293Z", "deleted_at": null, "sha1_hash": "7401936ff2edcb21fc02cdeb8443e7903abfb1d2", "title": "Six Palestinian human rights defenders hacked with NSO Group’s Pegasus Spyware", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 600642, "plain_text": "Six Palestinian human rights defenders hacked with NSO Group’s\r\nPegasus Spyware\r\nArchived: 2026-04-05 15:57:39 UTC\r\nOn 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading\r\nPalestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under\r\nIsrael’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children – Palestine;\r\nthe Union of Agricultural Work Committees; Bisan Center for Research and Development; and the Union of\r\nPalestinian Women Committees.\r\nDownload the Investigation (PDF)\r\nThis move is intended to not only criminalize these organizations, but to cut off their funding and other forms of\r\nsupport they receive from international partners and supporters. Front Line Defenders condemns Israel’s effort to\r\ncriminalize support for well-respected and long-serving human rights defenders and their organizations, as it has\r\nwhen other such measures were introduced in countries like Russia, Egypt and Nicaragua.\r\nWhile this latest move by the Israeli government is part of an alarming trend that is designed to try to stop the\r\nwork of human rights organisations and human rights defenders, the timing and method of the designation\r\nsuggests that it is also an effort to legitimate the surveillance and infiltration of the devices of Palestinian human\r\nrights defenders using Pegasus spyware, as discovered by a Front Line Defenders forensic investigation (see\r\ntimeline below).\r\nOn 16 October 2021, Front Line Defenders was contacted by-Al Haq, a human rights organisation in Palestine,\r\nabout the device of a Jerusalem-based staff member and a possible infection with spyware. Front Line Defenders\r\nimmediately conducted a technical investigation, and found that the device had been infected in July 2020, with\r\nspyware sold by Israel-based NSO Group. Front Line Defenders began investigating other devices belonging to\r\nmembers of the 6 designated Palestinian civil society organizations, and found that five additional devices were\r\nhacked with the same spyware. Front Line Defenders shared the data it gathered from the phones with Citizen Lab\r\nand Amnesty International’s Security Lab for independent peer review. Both confirmed, with high confidence,\r\nFront Line Defenders conclusion that the phones were hacked with Pegasus.\r\nCitizen Lab\r\nTechnical Report\r\nAmnesty International Security Lab\r\nTechnical Report\r\nTimeline\r\nDATE ACTION\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 1 of 7\n\n16 October\r\nFront Line Defenders contacted by Al-Haq\r\nregarding suspicions about phone hacking\r\n16 October\r\nFront Line Defenders Digital Protection Coordinator (DPC),\r\nMohammad Al-Maskati begins forensic investigation of first device\r\nand discovers indications of Pegasus spyware\r\n16 October\r\nFront Line Defenders shares data from logs with\r\nCitizen Lab to confirm findings\r\n17 October\r\nFront Line Defenders DPC meets with representatives of all\r\n6 designated organizations to inform them of Pegasus infiltration\r\nand to request additional devices to investigate\r\n18 October\r\nHRD Salah Hammouri, whose phone was one of six infiltrated by\r\nPegasus, notified of the Israeli Minister of Interior’s decision to\r\nrevoke his permanent residency in Jerusalem and deport him\r\non the basis of his alleged “breach of allegiance to the State of Israel”.\r\n19 October\r\nIsraeli Minister of Defense, Benny Gantz, issues executive order\r\ndesignating the 6 Palestinian human rights organisations\r\nas ‘terrorists’ – Designations No. 371 – 376\r\n24 October\r\nFront Line Defenders shares data from logs with\r\nCitizen Lab to confirm findings\r\n25 October\r\nFront Line Defenders shares data from logs with\r\nCitizen Lab to confirm findings\r\n26 October\r\nFront Line Defenders shares data from logs with\r\nCitizen Lab to confirm findings\r\n29 October Front Line Defenders confirms infection on 6 devices\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 2 of 7\n\n29 October\r\nFront Line Defenders shares data from logs and\r\nfiles from the phones’ backup with\r\nAmnesty International’s Security Lab to confirm findings\r\n1 November\r\nHaaretz reports that the 6 organisations remain legal in the\r\nWest Bank, despite the Minister’s executive order,\r\nand that “For an organization to be declared a 'disallowed association'\r\nin the West Bank, the commander of the IDF’s Central Command must\r\nissue an order, but the office said that no such order was issued,\"\r\nand that “Sources at the State Prosecutor’s Office have already\r\nconceded that they do not intend to file indictments against\r\nthe organizations or their workers.”\r\n2 November\r\nIreland Foreign Minister, Simon Coveney, in an interview with\r\nthe Jerusalem Post, confirms that Ireland and the European Union\r\n“have not gotten any credible evidence to link the\r\nNGOs to terrorism” from the Israeli government.\r\n3 November\r\nUS Department of Commerce places NSO Group on its ‘entity list’,\r\nbarring the company from buying parts and components\r\nfrom US companies without a special license.\r\n4 November\r\n+972 Magazine and The Intercept report that Israel hoped a\r\n74-page classified Shin Bet document,1\r\nthat was obtained by the two media outlets,\r\nwould convince European governments to stop funding\r\nPalestinian rights groups, but that it failed because\r\nof lack of “concrete evidence”.\r\nThe documents rely on the discredited testimony obtained by\r\nthe alleged torture of two former, employees of the\r\nHealth Work Committee.2\r\nInvestigation \u0026 Technical Information\r\nFront Line Defenders investigated 75 iPhones and found that 6 devices were hacked with NSO Group's Pegasus\r\nspyware. Citizen Lab and Amnesty International’s Security Lab each confirmed FLD’s analysis. Three victims\r\nconsented to be identified (listed below), and three wished to remain anonymous:\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 3 of 7\n\n1. Ghassan Halaika: Field researcher and human rights defender working for Al-Haq\r\n2. Ubai Al-Aboudi: Executive Director at Bisan Center for Research and Development. Ubai Al-Abdoudi\r\nholds US citizenship.\r\n3. Salah Hammouri: Lawyer and field researcher at Addameer Prisoner Support and Human Rights\r\nAssociation based in Jerusalem. On 18 October 2021, human rights defender and lawyer Salah Hammouri\r\nwas notified of the Israeli Minister of Interior’s decision to revoke his permanent residency in Jerusalem\r\nand deport him on the basis of his alleged “breach of allegiance to the State of Israel”. Salah Hammouri is a\r\ncitizen of France.\r\nThe investigation conducted by FLD included:\r\n* A scan of the iPhone devices from the 6 human rights organizations and human rights defenders from these\r\norganisations.\r\n* FLD shared data from its scans, including the findings indicating Pegasus spyware, with Citizen Lab and\r\nAmnesty International Security Lab, each of which confirmed FLD’s findings.\r\nFLD found traces of process names associated with NSO Group's Pegasus spyware on iPhones belonging to six\r\nhuman rights defenders:\r\n1. Ghassan Halaika's phone showed traces of the Pegasus process smmsgingd in July 2020.\r\n2. Ubai Al-Aboudi's phone showed traces of the Pegasus processes MobileSMSd, CommsCenterRootH[...]\r\nand otpgrefd in February 2021.\r\n3. Salah Hammouri's phone showed traces of the Pegasus processes ctrlfs and xpccfd in April 2021.\r\n4. Human Rights Defender 4 phone showed traces of the Pegasus process bundpwrd in April 2021.\r\n5. Human Rights Defender 5 phone showed traces of the Pegasus processes launchrexd, gssdp, launchafd,\r\ncom.apple.Mappit, cfprefssd, libtouchregd, ABSCarryLog and contextstoremgrd in February and\r\nApril 2021.\r\n6. Human Rights Defender 6 phone showed traces of the Pegasus process accountpfd in November 2020.\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 4 of 7\n\nAmnesty International's Security Lab has published research attributing these process names to NSO Group's\r\nPegasus spyware. Some of these processes were determined by Citizen Lab to be the same as used against other\r\nhuman rights defenders and journalists in other countries.\r\nWhen Pegasus is installed on a person’s phone, an attacker has complete access to a phone’s messages, emails,\r\nmedia, microphone, camera, passwords, voice calls on messaging apps, location data, calls and contacts. The\r\nspyware also has the potential to activate the phone camera and microphone, and spy on an individual's calls and\r\nactivities. As such, the spyware not only allows for the surveillance of the target, but also anyone with whom they\r\nhave contact via that device. This means that, in addition to the targeting of Palestinians, including dual nationals,\r\nnon-Palestinians (including foreign nationals and diplomats) with whom these victims were in contact, including\r\nIsraeli citizens, could have also been subject to this surveillance, which, in the case of its citizens, would amount\r\nto a breach of Israeli law.\r\nIn July 2021, a global investigation by the Washington Post, the Guardian, Le Monde and other news outlets\r\nreported that Pegasus spyware has been used to monitor human rights defenders, journalists and politicians around\r\nthe world. NSO Group has denied reports that the Pegasus spyware is used in the mass surveillance of human\r\nrights defenders; according to the company, Pegasus is intended for use only by government intelligence and law\r\nenforcement agencies to fight terrorism and crime. As such, the Israeli designation of these organizations as\r\n‘terrorists’ after Pegasus was detected, but just days before this investigation is reported, appears to be a clear\r\neffort to cover its actions and disconnected from any evidence that would discredit these organizations.\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 5 of 7\n\n‘Terrorist' Designation \u0026 Discredited ‘Evidence’\r\nThe ‘terrorist’ designation made against these organizations could allow Israeli authorities to close their offices;\r\nseize their assets, including bank accounts; arrest and jail their staff members; interfere with their international\r\nfunding and donor relations; and frustrate their efforts to monitor and document Israeli government violations.\r\nAside from the impact on these six organizations, this measure, by targeting some of the longest-established and\r\nmost respected organizations, as well as those with high profiles internationally, serves as an act of intimidation to\r\nother Palestinian organizations. This designation should be seen as an all-out assault on Palestinian human rights\r\ndefenders and civil society, particularly on their efforts towards accountability and justice.\r\nAttacks and campaigns against Palestinian human rights organisations and other civil society organisations have\r\nbeen carried out for years by the Israeli authorities. As documented in a report published by the Observatory for\r\nthe Protection of Human Rights Defenders in April 2021, these practices intensified over the past six years, in the\r\ncontext of the upheaval caused by the Trump administration in the United States and the expected opening of an\r\ninvestigation by the International Criminal Court. The report found that the strategies put in place by the Israeli\r\nGovernment is threefold: one, delegitimising civil society critical voices through “naming and shaming” and\r\nlabeling them as 'terrorists' or 'anti-Semitic'; two, pressuring institutions from giving a platform for Palestinian\r\nvoices and perspectives that seek accountability or justice; three, actively lobbying to cut sources of funding for\r\nPalestinian organizations, especially those that have been part of civil society efforts towards accountability.\r\nResorting to smear campaigns, intimidation and harassment measures, new restrictive legislation, administrative\r\nor judicial harassment and increased pressure on international donors who support those organisations have\r\nproven to be effective tactics to destabilise NGOs and undermine human rights defenders.\r\nThese tactics have also targeted other actors, including key health organisations in Palestine such as the Health\r\nWork Committee, which provides medical support to vulnerable communities, and UN mandate holders, who play\r\na key role in exposing Israeli violations.\r\nFront Line Defenders strongly condemns the decision and allegations of terrorism brought against these\r\nPalestinian human rights organisations in response to their peaceful human rights work. Human rights defenders\r\nare not terrorists. This development marks a grave expansion of Israel's systematic policies and practices intended\r\nto silence Palestinian human rights defenders who seek justice and accountability for violations of Palestinians\r\nhuman rights. This attack also puts the future of child protection, women’s rights, rights of prisoners and the\r\nability to document human rights violations at significant risk.\r\nRecommendations\r\nFront Line Defenders calls on all stakeholders – states, international bodies, corporations and law enforcement\r\nauthorities to clearly and unequivocally reject the terrorism charges brought against Palestinian human rights\r\norganisations and human rights defenders.\r\nThe international community, including the EU and its member states, should stand firm in its support to\r\nPalestinian human rights defenders by publicly condemning this flagrant attack on the Palestinian human rights\r\nmovement and by urging Israel’s Minister of Defense to immediately rescind the designation of the six human\r\nrights organisations as “terrorist organisations,” making clear that counter-terrorism legislation should never be\r\nused to constrain legitimate human rights work. The EU and its member states should also continue to fund these\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 6 of 7\n\norganisations for their legitimate human rights activities and mirror the United States recent decision to blacklist\r\nthe NSO Group. Front Line Defenders calls for an immediate global moratorium on the export, sale, transfer and\r\nuse of surveillance technology until an adequate human rights regulatory framework is in place.\r\n______\r\n1\r\n These documents were shared with European governments starting in May 2021.\r\n2\r\n The Health Work Committee is a Palestinian organisation working on women’s and children’s health. In March\r\n2021, two of its former employees were arrested by Israel – their employment had previously been terminated by\r\nthe organisation. The organisation had been declared a ‘terrorist’ organisation on 22 January 2020, similar to the\r\ndetermination made on the 6 organisations in this statement. On 13 April 2021, Juana Ruiz Sanchez, a Spanish\r\nnational married to a Palestinian and project coordinator at the organisation was arrested and has been detained\r\nsince. On 9 June, Israeli forces closed down the office of the Health Work Committee in Ramallah for 6 months.\r\nOn 7 July, Shatha Odeh, the organisation’s Director, was arrested from her home; fabricated charges have been\r\nfiled against her and she remains in detention.\r\nSource: https://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nhttps://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus\r\nPage 7 of 7", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus" ], "report_names": [ "statement-targeting-palestinian-hrds-pegasus" ], "threat_actors": [ { "id": "42a6a29d-6b98-4fd6-a742-a45a0306c7b0", "created_at": "2022-10-25T15:50:23.710403Z", "updated_at": "2026-04-10T02:00:05.281246Z", "deleted_at": null, "main_name": "Silence", "aliases": [ "Whisper Spider" ], "source_name": "MITRE:Silence", "tools": [ "Winexe", "SDelete" ], "source_id": "MITRE", "reports": null }, { "id": "eb5915d6-49a0-464d-9e4e-e1e2d3d31bc7", "created_at": "2025-03-29T02:05:20.764715Z", "updated_at": "2026-04-10T02:00:03.851829Z", "deleted_at": null, "main_name": "GOLD WYMAN", "aliases": [ "Silence " ], "source_name": "Secureworks:GOLD WYMAN", "tools": [ "Silence" ], "source_id": "Secureworks", "reports": null }, { "id": "88e53203-891a-46f8-9ced-81d874a271c4", "created_at": "2022-10-25T16:07:24.191982Z", "updated_at": "2026-04-10T02:00:04.895327Z", "deleted_at": null, "main_name": "Silence", "aliases": [ "ATK 86", "Contract Crew", "G0091", "TAG-CR8", "TEMP.TruthTeller", "Whisper Spider" ], "source_name": "ETDA:Silence", "tools": [ "EDA", "EmpireDNSAgent", "Farse", "Ivoke", "Kikothac", "LOLBAS", "LOLBins", "Living off the Land", "Meterpreter", "ProxyBot", "ReconModule", "Silence.Downloader", "TiniMet", "TinyMet", "TrueBot", "xfs-disp.exe" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434196, "ts_updated_at": 1775792128, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/7401936ff2edcb21fc02cdeb8443e7903abfb1d2.pdf", "text": "https://archive.orkl.eu/7401936ff2edcb21fc02cdeb8443e7903abfb1d2.txt", "img": "https://archive.orkl.eu/7401936ff2edcb21fc02cdeb8443e7903abfb1d2.jpg" } }