Pegasus spyware was used to hack into the cellphone of Galina Timchenko, the CEO of the independent Russian news website Meduza, the outlet said Wednesday.
The incident marks the first known case of Pegasus being used against a Russian journalist, Meduza said.
Timchenko’s phone appeared to have been hacked in February just hours before she joined a private conference in Berlin attended by exiled Russian journalists.
Meduza said the spyware could have been used as a wiretap to record conversations at the meeting, where it was running in the background.
The digital rights organization Access Now and the University of Toronto’s Citizen Lab collected data from Timchenko’s phone and confirmed that the device was hacked with Pegasus, according to Meduza.
Pegasus, a spyware designed by the Israeli company NSO Group, can be installed on a phone remotely. It has been used to target human rights activists, diplomats and journalists and their families, including the widow of slain Saudi journalist Jamal Khashoggi, who claimed her device was hacked with the spyware.
The spyware gave the hackers total access to Timchenko’s iPhone, its microphone and its cameras. Data stored on her phone such as her home address, scheduled meetings and correspondence on encrypted messengers was also exposed, the outlet said.
Two weeks before Timchenko’s phone was hacked, Russia's Prosecutor General's Office designated Meduza an “undesirable” organization, banning it from operating inside Russia. The label makes it a criminal offense for Russians to associate with Meduza in any way, including by making financial donations.
Meduza said it could not reveal who was behind the attack.
“My first thought was the Russian state and the Russian intelligence agencies, of course,” Timchenko said. “Who else cares about me?”
According to Meduza, Kazakhstan or Azerbaijan — two suspected Pegasus clients — could have carried out the attack at Moscow’s request.
European countries such as Latvia, where Meduza was founded in exile in 2014, as well as Estonia and Germany, were also among the potential suspects, Meduza said.
NSO Group declined to answer Meduza’s questions about whether it knew of the attack on Timchenko.
“I’m absolutely shocked we’re seriously discussing that a European state could have done this,” Meduza editor-in-chief Ivan Kolpakov said.
“I’m probably naive, but this seemed impossible to me. The consequences could be devastating, and this concerns not just the news media in exile but the media in Europe generally,” he said.
