Often, threat actors that target civil society groups also go after well-resourced governments and businesses and are equipped accordingly. But their civil society victims are usually limited in their capacity to identify and mitigate threats, even when the consequences can mean imprisonment or
physical harm.

When the Citizen Lab begins their investigations, these targets are often at serious risk, and in many cases, besieged by threat actors working for the governments and regimes under which they live. Without these researchers, people like renowned UAE human rights defender, Ahmed Mansoor, whose iPhone was attacked via remote jailbreak using a string of zero-days, or the Latin American journalists targeted by an extensive phishing campaign linked to malware and fake news sites, would have little to no recourse.

RiskIQ PassiveTotal® helps the Citizen Lab enrich its investigations of targeted espionage operations by mapping their infrastructure and monitoring how it changes over time. One of the first steps Citizen Lab researchers take when examining a new sample of malware or phishing is quickly looking for related infrastructure inside PassiveTotal’s web interface and Maltego Transforms, which can provide unmatched insight into the behavior of the threat actors they’re tracking.

Infrastructure tracking enriched by PassiveTotal also shows researchers how threat actor tactics change over time. For example, finding repurposed parts of known malware command and control infrastructure in phishing attacks indicates a shift in tactics from targeted malware campaigns to conventional phishing. This intelligence would then help the Citizen Lab recommend defensive measures such as using two-factor authentication and avoiding sending and receiving file attachments by email.

With PassiveTotal, the Citizen Lab linked the intrusion attempt on Ahmed Mansoor to infrastructure operated by NSO Group, a vendor of commercial spyware for governments. The investigation led to Apple releasing an out of band patch for IOS, as well as international media coverage of how some commercial surveillance products sold exclusively to governments are being used against civil society.

In the case of phishing emails targeting Latin American journalists, the researchers used PassiveTotal to connect the phishing infrastructure to both malware command and control servers, and to a pattern of fake news websites. This information helped them identify a threat actor and actively monitor its behavior.