Keir Giles, a prominent expert on Russia, was targeted with a new form of social-engineering attack that leverages App-Specific Passwords. Google links the operation to UNC6293, a Russian state-backed group.
On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists who consented to the technical analysis of their cases. In this report, we discuss key findings from our forensic analyses of their devices.
Irene Poetranto examines Indonesia’s use of domain name system (DNS) redirection as a method of internet censorship in a new essay published by the Carnegie Endowment for International Peace. In Techno-Legal Internet Controls in Indonesia and Their Impact on Free Expression Poetranto explains how DNS redirection, a new type of DNS tampering, was introduced in… Read more »
Our investigation of a spearphishing campaign that targeted senior members of the World Uyghur Congress in March 2025 reveals a highly-customized attack delivery method. The ruse used by attackers replicates a pattern in which threat actors weaponize software and websites aimed at preserving and supporting marginalized and repressed cultures to target those same communities.
A sustained, coordinated social media harassment and doxxing campaign – which we codenamed JUICYJAM – targeting the pro-democracy movement in Thailand has run uninterrupted, and unchallenged, since at least August 2020. Through our analysis of public social media posts we determined that the campaign was not only inauthentic, but the information revealed could not have been reasonably sourced from a private individual.
Un’introduzione a Paragon Solutions. Paragon Solutions è stata fondata in Israele nel 2019 e vende uno spyware chiamato Graphite. L’azienda si descrive come diversa dagli altri produttori, affermando di disporre di salvaguardie per prevenire i tipi di abusi di spyware per cui NSO Group e altri fornitori sono noti. Analisi dell’infrastruttura dello spyware Paragon. Sulla… Read more »
In our first investigation into Israel-based spyware company, Paragon Solutions, we begin to untangle multiple threads connected to the proliferation of Paragon’s mercenary spyware operations across the globe. This report includes an infrastructure analysis of Paragon’s spyware product, called Graphite; a forensic analysis of infected devices belonging to members of civil society; and a closer look at the use of Paragon spyware in both Canada and Italy.
A new book co-authored by Siena Anstis, senior legal advisor at The Citizen Lab, is now available for purchase. Transnational Repression and International Law explores the rise of state-sponsored extraterritorial killings and the implications for international law. Order your copy here.
Our network security analysis of the popular social media app, RedNote, revealed a number of issues with both the Android and iOS versions of the app.
Reporting to the Director of Administration, Citizen Lab and working under the general direction of the Director, Citizen Lab in coordination with the University of Toronto’s Chief Information Security Officer (CISO), the Systems and Security Technical Lead is responsible for working with Information Technology staff and resources at Citizen Lab and the wider University to minimize risk of the compromising of information, data, servers, and server-based applications.
