Thread by @jsrailton

BREAKING: @Google just exposed Variston, a previously-unknown mercenary #spyware vendor.

Based in 🇪🇸#Spain.

#Europe can't go a week without a spyware scandal. 1/

By @_clem1 & @benoitsevens at Google TAG
blog.google/threat-analysi…

2/ Google's Threat Analysis Group first learned of Variston's shenanigans...from an anonymous tip.

Someone clearly had it in for the mercenary #spyware vendor.

But also: yet again, suggests that EU Governments really aren't doing much to rein in sketchy commercial players.

3/ Google TAG found Variston could exploit Chrome Browser & Firefox.

And Windows Defender.

Diverse little portfolio of ways to get onto a device.

Google thinks they were being used as 0-days before being fixed.

Ft. @ifsecure @maddiestone & @_tsuro

4/ Coincidentally to the Variston case, yesterday the @EP_PegaInquiry held a hearing about #Spain's own #Pegasus scandal.

Featuring a spyware denialist peddling debunked claims & not-very-forthcoming Spanish officials.

By @vmanancourt & @shannonvansant
politico.eu/article/eu-spy…

5/ Key takeaway: while you've heard of notorious #spyware like #Pegasus & #Predator, there is a whole ecosystem of shady players.

Some operate from the 🇪🇺#EuropeanUnion.

Right now they skirt along with no serious oversight or accountability.

This. Must. Change.

6/ Some 🇪🇺EU member states have #spyware skeletons.

And have tried to block the @EP_PegaInquiry.

For example, the #Greek response to #PredatorGate is an embarrassment.

It's myopic. And in the long run harmful to our collective security.

Source: lighthousereports.nl/investigation/…

Agreed with @ShaneHuntley here.

Also a good thread on his team's work uncovering this.👇

https://twitter.com/ShaneHuntley/status/1598003009757192194