In 2016 the United Arab Emirates came into possession of a very dangerous iPhone exploit : exploited a “zero click” vulnerability (ie: the user does not have to take any action to be hacked) in iMessage, and was employed to monitor hundreds of activists, dissidents, NGOs and political rivals. Yesterday it emerged from two independent sources of the MIT Technology Review that it was Accuvant, a US cybersecurity company to sell the hack to a group of mercenaries, also from the US , for 1, $ 3 million.
The mercenaries would then use the exploit on behalf of the Emirati government . Operations with this degree of delicacy require government authorization, but the mercenaries decided to act independently. The existence of the exploit was first documented in 2019 by Reuters : Everything revolved around a software called Karma and controlled by DarkMatter, a hacker organization that portrays itself as a private collective, but which is clearly piloted by the Emirati government (it is also behind the ToTok spy app). Over the years, DarkMatter has been linked to many attacks conducted on US targets, despite the fact that the two nations are formally allied.
Investigations have apparently found that Accuvant acted in good faith – the only convicted are the three mercenaries, who were fined 1, 68 million dollars. The company has meanwhile merged with another player in the cybersecurity industry, and the remaining parts have been absorbed by a larger group called Optiv. The “vicious circle” remains real, however, and shows that all in all the incipit of the first Marvel movie of Iron Man is not so far-fetched, quite the contrary.
In fact, the news sheds light on a phenomenon, that of exploits sold illegally and ended up in the wrong hands , which in the latter threaten the safety of the creators themselves. To put it in the words of the source:
Aided by US partnerships, money and experience, DarkMatter has built the UAE’s cyber-offensive capabilities from practically nothing to an active and fearsome operation. The group has invested huge sums to enlist American and Western hackers to develop and occasionally even direct the country’s cyber operations.