Citizen Lab’s Bill Marczak helped Privacy International scan Ethiopian refugee Tadesse Biru Kersmo’s computer, and they found traces that showed FinSpy had been operating in June 2012 over two days while he was in the UK.
Kersmo left his home country in 2009 after enduring four years of “continuous harassment and intimidation”. He was a lecturer, working in Unity University, Addis Ababa when his wife was elected as a member of the capital’s city council for the opposition party, Coalition for Unity and Democracy. The government promptly reversed the outcome and declared itself the winner.
He read a report by the Citizen Lab that revealed a FinSpy campaign in Ethiopia had used pictures of members of the opposition group Ginbot 7 (including Kersmo) to get people to click on links and infect their systems.
For more on this story, see the Wired UK story.