Targeted Threats
Investigations into the prevalence and impact of digital espionage operations against civil society groups. For our research on Digital Transnational Repression, visit this page to explore our reports, media mentions, and resources.
Featured in Targeted Threats
Digital Transnational Repression Explained
Citizen Lab produced an animated explainer video on digital transnational repression in Canada that also highlight some of the stories of the interviewees while also protecting their identities.
Latest Research
Marcus Michaelsen on the Impacts of Transnational Repression: Interview by Stockholm Center for Freedom
What’s stopping diaspora members from speaking up against the government in their home country? In an interview with the Stockholm Center for Freedom (SCF), Citizen Lab senior researcher Marcus Michaelsen discusses digital transnational repression (DTR) and its impacts on diasporas worldwide. Read the interview.
The G7 Condemned Transnational Repression, But Will Canada Meet Its Own Commitments?
“Transnational repression is a phenomenon that is only growing in scope, scale and sophistication worldwide,” writes Ron Deibert in his new op-ed for the Globe and Mail.
Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords
Keir Giles, a prominent expert on Russia, was targeted with a new form of social-engineering attack that leverages App-Specific Passwords. Google links the operation to UNC6293, a Russian state-backed group.
Graphite Caught: First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted
On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists who consented to the technical analysis of their cases. In this report, we discuss key findings from our forensic analyses of their devices.
Weaponized Words: Uyghur Language Software Hijacked to Deliver Malware
Our investigation of a spearphishing campaign that targeted senior members of the World Uyghur Congress in March 2025 reveals a highly-customized attack delivery method. The ruse used by attackers replicates a pattern in which threat actors weaponize software and websites aimed at preserving and supporting marginalized and repressed cultures to target those same communities.