Software from Israeli spyware company NSO Group Technologies Ltd. has been found being used to target journalists and activists in the latest controversy involving the company.

According to an investigation published today, led by The Washington Post and 16 media partners, the NSO software was used in attempted or successful hacks of 37 smartphones belonging to journalists, human rights activists, business executives and two women close to murdered Saudi journalist Jamal Khashoggi.

The numbers appeared on a list of more than 50,000 phone numbers based in countries known to surveil people. The list itself was shared by journalism nonprofit Hidden Stories and Amnesty International. Amnesty described obtaining the data through a leak but did not provide additional information.

Those targeted by the NSO software were targeted using Pegasus, military-grade software described as possibly the most potent piece of spyware ever developed.

The Post was also able to match around 1,000 of the 50,000 numbers to targets across 50 countries. Others targeted included Arab royal family members, at least 65 business executives, 85 human rights activists, 189 journalists and more than 600 politicians and government officials. Heads of state and prime ministers were also on the list.

Some journalists targeted included those working for CNN, The Associated Press, Voice of America, The New York Times, The Wall Street Journal, Bloomberg News, Le Monde, the Financial Times and Al Jazeera.

NSO has denied the findings of the investigation, telling the Post that they are exaggerated and baseless. It also denied operating spyware used by clients and has no insight into their intelligence efforts.

The “we know nothing” claim by NSO may be fair, since it may not be aware of what its clients do with the software it develops, but it’s still its software and this isn’t the first time the company has been linked to hacking.

In October 2019, Facebook Inc. alleged that NSO hacked about 1,400 WhatsApp users using U.S. servers. At a hearing in April 2020, NSO alleged that it had sovereign immunity from the lawsuit since it works hand-in-hand with foreign government intelligence agencies, whereas Facebook argued it was liable under U.S. law since it had used U.S. servers.

Image: NSO Group