This post describes the results of a comprehensive global Internet scan for the command and control servers of FinFisher’s surveillance software. It also details the discovery of a campaign using FinFisher in Ethiopia that may have been used to target individuals linked to an opposition group. Additionally, it provides examination of a FinSpy Mobile sample found in the wild, which appears to have been used in Vietnam.

This report, written and coordinated by Citizen Lab Technical Advisor Morgan Marquis-Boire, analyzes several samples we believe to be mobile variants of the FinFisher Spy Kit targeting iPhone, Android, Blackberry, Windows Mobile and Symbian platforms. It is a follow-on to a previous research brief, From Bahrain with Love: FinFisher's Spy Kit Exposed?, that analyzed several pieces of malware targeting Bahraini dissidents.

Archives of Citizen Lab Briefing newsletters we’ve sent. Subscribe to the Citizen Lab newsletter. Privacy Policy 2018 | 2017 | 2016 | 2015 | 2014 | 2013 | 2012 | 2011 2019 February 2019 – Citizen Lab researchers targeted, continued abuse of NSO technology in Mexico, and applications open for 2019 Citizen Lab Summer Institute 2018 November… Read more »

A basement in the gray, Gothic heart of the University of Toronto is home to the CSI of cyberspace. “We are doing free expression forensics,” says Ronald Deibert, director of the Citizen Lab, based at the Munk Centre for International Studies. Deibert and his team of academics and students investigate in real time governments and… Read more »

Jump to: Citizen Lab Reports External Publications Submissions Op-Eds, Letters, & Comments Books Guides Joint Reports OpenNet Initiative   Citizen Lab Reports Rebekah Brown, Marcus Michaelsen, Matt Brooks, and Siena Anstis. “Weaponized Words: Uyghur Language Software Hijacked to Deliver Malware,” Citizen Lab Report No. 185, University of Toronto, April 28, 2025. Alberto Fittarelli, M. Scott,… Read more »