Pegasus Spyware & Not-For-Profit Cyber Security - What Are The Risks?

When working with charities, in any capacity, the first priority is the beneficiaries, whether people, animals or the planet. And, for many charities and not-for-profits, where donations, often irregular, make up the vast proportion of income, it can be hard to prioritise efforts outside of helping those who need it.  

However, with NSO Group’s Pegasus software being increasingly used by bad actors, it’s incredibly important to prioritise your cyber security efforts when working in charity, especially for those involved in humanitarian efforts. 

What Is The Pegasus Spyware? 

Pegasus was developed by NSO Group with the aim of counter terrorism and crime prevention. Sold to only government law enforcement and intelligence clients, Pegasus was developed with good intentions, but has been increasingly used for opposition spying, humanitarian crackdown and on journalists investigating potentially damaging stories. 

How Does Pegasus Work? 

Pegasus works using a zero-injection process, whereby an individual does not need to do anything for the software to be added to their phone, and they may not even notice. 

Then, once added to a person’s phone, every activity a person does can be seen and monitored, from the camera and microphone to every call made. Essentially, it turns a person’s phone into a full spyware device, capable of transmitting image and voice, even if the camera hasn’t been opened. This makes it incredibly powerful in crime and terrorism prevention, but also when used in opposition spying and use on innocent citizens and government officials. 

What Are The Risks To Charities? 

Charites and not for profits, as well as those carrying out humanitarian aid, are always at risk of hacking, spyware and tracking of any sorts. Anything that puts a government or presiding body at risk, or goes against someone’s authoritarian principles, is at risk of being followed in some way. 

The cybersecurity risks to charities include: 

  • Sensitive information on whereabouts of at-risk people being obtained. As the Pegasus spyware can be used to infiltrate cameras and microphones, conversations can be overhead and information regarding the movement of high-risk people. 
  • State sponsored hacking being used on people of interest.
  • Unknowingly sharing details on confidential work.
  • Access to private information that could put the person at risk.

Why Are Charities At Particular Risk? 

As charity work is often carried out anytime, anywhere, by people of all kinds, the risk of spyware being installed and used to infiltrate potentially high-risk individuals is greater. Similarly, if a person is easily identifiable as working for a charity, especially one that carries out humanitarian aid or similar work, then the software can easily be installed and used to track information. 

This particular method of identification became known recently, when US State Department workers who linked their state.gov email address with their Apple ID, were targetted while working in Uganda, an area of high political tension currently. While NSO Group says they have prevented their intrusion method from working on US phone numbers beginning with +1, if someone is using another phone number, or has an obviously identifiable email address, then they put themselves at high risk. 

How Can Charities Protect Themselves? 

While a cyber attack cannot be prevented from being instigated, measures can be put in place to make users aware of the potential risks. 

Update to latest security patches:   When a new security patch is released, it’s important to update to the latest version as soon as possible. Security patches are different to normal updates as they fix an issue that has been identified, rather than providing new features. 

Educate staff and volunteers on spotting potential cyber security issues:   Many cybersecurity attacks can be minimised through education of staff and volunteers. Things like using a password manager, having an IT support team to contact with questions and questioning emails that seem odd, are all important parts of a prevention strategy. 

Separate work and personal devices:   Our guard often comes down when using personal devices or conducting personal matters. To prevent cyber attacks happening in homes, separate any work onto a different device, and use different computers where possible. 

Kitty Bates is a cybersecurity content expert at outsourced IT support provider ramsac.

You Might Also Read: 

Spyware - Apple Starts Legal Action Against NSO Group:

« The Top 10 Most Severe Vulnerabilities In 2021
Russia Fines Google For Illegal Content Breach »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

TZ-CERT

TZ-CERT

TZ-CERT is the National Computer Emergence Response Team of Tanzania.

BeOne Development

BeOne Development

BeOne Development provide innovative training and learning solutions for information security and compliance.

Insta Group

Insta Group

Insta are a trusted cyber security partner for security-critical companies and organizations.

PrimaTech

PrimaTech

PrimaTech provide process safety, cyber and process security, and risk management consulting, training and software for the process industries.

Cybraics

Cybraics

Cybraics nLighten platform implements a unique and sophisticated artificial intelligence engine that rapidly learns your environment and alerts security teams to threats and vulnerabilities.

Crossmatch

Crossmatch

Crossmatch is a world leader in risk-based composite authentication and biometric identity management.

Elastic

Elastic

Elastic is the world's leading software provider for making structured and unstructured data usable in real time for search, logging, security, and analytics use cases.

Clearswift

Clearswift

Clearswift is trusted by businesses, governments and defense organizations globally for its Adaptive Cyber Security and Data Loss Prevention solutions.

Arcanum Information Security (AIS)

Arcanum Information Security (AIS)

Arcanum Information Security is a specialist Information Assurance Consultancy and a leading provider of Cyber Security services to UK Defence, UK Government, Enterprise businesses and SMEs.

Brighter AI

Brighter AI

Brighter AI empowers companies to use publicly-recorded camera data for analytics & AI while being compliant with increasing data privacy regulations worldwide.

OwnZap Infosec

OwnZap Infosec

OwnZap Infosec aims to digitally shield the cyberspace by offering services like Penetration Testing and Red Teaming, Infrastructure Security Testing, and Vulnerability Assessments.

Cynomi

Cynomi

Cynomi is a leading strategic cybersecurity operations platform that automates cybersecurity knowledge and expertise to empower teams with little to no in-house expertise.

SecAlliance

SecAlliance

SecAlliance is a cyber threat intelligence product and services company.

CFTS

CFTS

CFTS 'Computer Facilities Technical Services' is a Ugandan ICT Support Company that specialises in infrastructure and support services including network security.

Anonos

Anonos

Anonos is a global software company that provides the only technology capable of protecting data in use with 100% accuracy, even in untrusted environments.

SecZone

SecZone

SecZone is a Chinese enterprise with a mission to "Make It Secure." We are dedicated to driving software security innovation globally.