Thread on our latest #BhimaKoregaon investigation: @SentinelOne dug into phishing emails received by Rona Wilson to piece together how he was targeted. What they found was startling: Two distinct groups attacked him in the same time period. 1/n washingtonpost.com/world/2022/02/…
Wilson received dozens of emails — often from other activists he knew and sometimes disguised as news articles — that contained malware designed to infiltrate his computer. 2/n washingtonpost.com/world/2022/02/…
The primary group, that report calls ModifiedElephant, planted evidence on his laptop including the letter about plot to kill the PM. This group shared infrastructure with a known hacker, Hangover, that researchers have long suspected of state-sanctioned political espionage. 3/n
The second group that targeted Wilson was Sidewinder, that has been linked to widely documented cyberespionage campaigns against military targets in China and Pakistan, India’s top foreign adversaries. 4/n
“Two separate groups going after the same target suggests they were tasked with the job by the same entity,” said @juanandres_gs (co-author of the SentinelOne report). 5/n
The list of those targeted by ModifiedElephant goes beyond Wilson and others accused in the #BhimaKoregaon case. Dozens of other academics, lawyers, civil society members were sent malicious emails but it is not known how many were infected. 6/n
The report does not identify the people who carried out the attacks or the entity that ordered them but notes that ModifiedElephant’s activity sharply “aligns with Indian state interests.” 7/n
Our previous reporting confirmed that Wilson was hacked by Pegasus spyware as well. He has now spent more than three years in jail awaiting trial. 8/n
This means that a group of jailed govt critics were surveilled and targeted for years. The report offers new clues about connections between groups that cybersecurity experts have observed targeting foreign adversaries and domestic critics. 9/n
Link to the full report by @SentinelOne @juanandres_gs @TomHegel here: sentinelone.com/labs/modifiede… 10/n
• • •
Missing some Tweet in this thread? You can try to
force a refresh
