Report exposes NSO, ENFER, DarkMatter access brokers
Atlantic Council report profiles NSO Group, ENFER, and DarkMatter as commercial Access-as-a-Service firms proliferating offensive cyber capabilities to states, and proposes counterproliferation policy.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Atlantic Council report examines the 'Access-as-a-Service' (AaaS) industry, in which private firms sell offensive cyber capabilities—vulnerability research, malware, command-and-control infrastructure, operational management, and training—to government clients, primarily intelligence and security services. The authors argue that this commercial market, operating in semi-regulated jurisdictions, has become a major vector for the proliferation of offensive cyber capabilities (OCC) that existing export-control regimes like the Wassenaar Arrangement fail to adequately address.
Three case studies anchor the analysis: NSO Group (Israel), whose Pegasus spyware has been linked by Citizen Lab research to surveillance of journalists, activists, and dissidents, including the 2020 Al Jazeera staff hacks attributed to UAE- and Saudi-linked operators (dubbed SNEAKY KESTREL and MONARCHY); ENFER, an alleged contractor to the Russian FSB/MoD operating at the boundary of criminal and state-sanctioned markets; and DarkMatter, a UAE firm that grew out of Project Raven and recruited former US intelligence personnel to build independent offensive capability for Emirati intelligence services. The report notes that fourteen of the seventy-two publicly attributed in-the-wild zero-day exploits tracked since 2014 originated from private commercial vendors (including NSO Group, Hacking Team, FinFisher/Gamma Group, and Exodus Intelligence) rather than states.
The report is a policy analysis rather than a technical incident report, closing with recommendations for governments to 'understand, shape, and limit' AaaS proliferation—via know-your-vendor laws, expanded selective disclosure, contracting preferences, post-employment reporting requirements for intelligence personnel, and technical restrictions such as geofencing. No active exploitation, specific CVEs, or new malware campaigns are detailed; the piece is informational/policy-oriented in nature.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/report/countering-cyber-proliferation-zeroing-in-on-access-as-a-service
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs