# Mercenary spyware industry threatens U.S. national security

Published: 2022-07-27 · Severity: elevated · Sectors: government-national, defense, telecommunications
Canonical: https://vorant.io/reports/d6e19836-0798-5482-9622-e36da5e0e1de/mercenary-spyware-industry-threatens-u-s-national-security

> Congressional testimony on proliferation of NSO Pegasus and similar mercenary spyware targeting U.S. officials, opposition figures, and civil society worldwide.

On July 27, 2022, Citizen Lab senior researcher John Scott-Railton testified before the House Permanent Select Committee on Intelligence about the growing threat posed by commercial spyware companies like NSO Group selling sophisticated hacking capabilities to state and non-state actors worldwide. The testimony documents how mercenary spyware has democratized access to previously nation-state-only capabilities, enabling pay-to-play customers without domestic offensive cyber expertise to conduct sophisticated mobile device compromises.

The core technical threat centers on zero-click exploits that require no user interaction—Pegasus and similar tools can silently enable microphones and cameras, exfiltrate encrypted messages from Signal and WhatsApp, steal cloud authentication tokens, and access all device data. Google Project Zero has characterized NSO's zero-click iMessage exploit as "one of the most technically sophisticated exploits we've ever seen." Victims documented include at least nine U.S. State Department officials, U.K. Foreign Office personnel, Polish opposition politicians, Thai pro-democracy activists, Catalan MEPs, El Salvadoran journalists, and Mexican activists—many hacked repeatedly over extended periods.

The testimony identifies critical national security and counterintelligence gaps: U.S. officials working overseas with non-U.S. phone numbers remain vulnerable; exploitation persists undetected until discovered by platform vendors; proliferation is enabling non-state actors and criminal organizations (documented cases in Mexico linking spyware to cartel activity); and U.S. venture capital continues funding companies in the sector despite Entity List designations of NSO Group and Candiru. Recommendations include intelligence community identification and disruption of problematic vendors, federal contract prohibition, export controls, extended revolving-door restrictions for intelligence community personnel, and diplomatic pressure on safe-haven jurisdictions.

## Mentioned in this report

- Threat actors: Candiru, Gamma Group, HackingTeam, NSO Group
- Malware: Candiru spyware, FinFisher, Hacking Team spyware, Pegasus
- Campaigns: CatalanGate, GeckoSpy, Pegasus Project, Project Torogoz

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://citizenlab.ca/john-scott-railton-delivers-testimony-to-house-permanent-select-committee-on-intelligence

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d6e19836-0798-5482-9622-e36da5e0e1de/mercenary-spyware-industry-threatens-u-s-national-security.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup