Newsroom Sues NSO Group for Pegasus Spyware Compromise

Nearly two dozen journalists and other staffers working for El Faro, a digital newspaper based in El Salvador, are suing NSO Group for unleashing Pegasus spyware — malware they say was used to steal their most sensitive information, putting their safety in danger.

Along with ASO Group Technologies, its Israeli parent company, Q Cyber Technologies is also named as a defendant in the lawsuit.

The 22 plaintiffs from El Faro are getting an assist from the Knight First Amendment Institute at Columbia University in their litigation. Attorneys for the El Faro group say that because Apple servers in Silicon Valley were compromised by Pegasus to monitor the newsroom, they have filed the lawsuit in the US District Court in Northern California.

Pegasus spyware has a long history of being used by authoritarian governments to essentially take full control of devices of those they deem likely to stoke dissent. Once Pegasus is deployed, the complaint explains, the threat actor has control of the entire device, from downloading contacts and text messages to turning on the device microphone to listen to conversations in real time.

“They can activate the smartphone’s camera to take photographs,” the complaint added. “They can also copy authentication keys to gain access to cloud-based accounts.”

Members of the news-gathering group at the influential Central American outlet claim they were targeted by the Salvadoran government while working on stories about human rights abuses and communicating with confidential sources, including the US Embassy, according to the court filing.

“The Pegasus attacks have profoundly disrupted Plaintiffs’ lives and work,” the Pegasus spyware suit claims. “The attacks have compromised Plaintiffs’ safety as well as the safety of their colleagues, sources, and family members.”