Meta bans seven surveillance-for-hire groups, including Cytrox, removing over 1,500 Facebook and Instagram accounts and alerting 50K users who were targeted

Cytrox is one of seven surveillance companies now banned from Meta's platforms — While NSO Group was taking flak for hacking …

TechCrunch 2021-12-17 Zack Whittaker

Context & Ripple Effects

In the weeks before this action, Meta had already disrupted global disinformation networks and a Nicaraguan government-linked troll farm. Banning commercial surveillance groups extends that enforcement arc from coordinated influence operations to actors targeting individual users.

The combination of account removals and notifications makes the action more than a takedown: Meta is treating affected Facebook and Instagram users as an active part of its response to platform-enabled surveillance.

First-order effects

Cytrox and six other surveillance-for-hire groups lose access to more than 1,500 removed Facebook and Instagram accounts, limiting their ability to use Meta’s services.
Meta’s alerts put 50,000 targeted users on notice that they were identified in the surveillance groups’ activity.

Second-order effects

Other surveillance-for-hire operators face a clearer Meta enforcement model: account disruption is paired with notifications to the people their activity targeted.
Meta’s security teams must sustain detection and user-notification workflows across both Facebook and Instagram rather than treating the removals as a one-off account purge.

Third-order effects

Alongside Meta’s actions against disinformation and state-linked networks, the case points to platform enforcement becoming a broader counter-abuse function spanning influence operations and targeted surveillance.
If Meta continues applying bans across related services, abusive operators’ access to large social-platform account networks becomes a less durable operating asset.

The trend: Major platforms are expanding coordinated-network enforcement from public influence campaigns toward commercial surveillance activity that targets individual users.

Discussion

@ngleicher Nathaniel Gleicher on x
4/ We've mapped each of these companies across the Surveillance Attack Chain: 3 stages (recon -> engagement -> exploit) that these companies follow as they target people for spying around the world. https://twitter.com/...
@evacide Eva on x
Just in case you're looking through the names of surveillance-for-hire companies Meta is taking action against and Belltrox sounds familiar, they were behind the Phish for the Future campaign @cooperq and I wrote about: https://www.eff.org/...
@marietjeschaake Marietje Schaake on x
More great work by @citizenlab on the spyware market (not just NSO) this time targeting @AymanNour ↘️ https://twitter.com/...
@dashdecosta Leon Dash on x
“The surveillance industry is much bigger than just one company. The targeting we see is indiscriminate. They're targeting journalists. They're targeting politicians. They're targeting human rights defenders. They're also targeting ordinary citizens.” https://www.washingtonpost.c…
@rj_gallagher Ryan Gallagher on x
Meta on Thursday named four Israeli firms as having been involved in providing the “surveillance-for-hire” services — Cobwebs Technologies, Cognyte, Black Cube & Bluehawk CI — in addition to India's BellTrox, North Macedonia's Cytrox & an unknown entity in China.
@migueldeicaza @migueldeicaza on x
Facebook is delivering our Xmas present: https://twitter.com/...
@davidakaye David Kaye on x
key explainer 🧵 from one of the leading #spyware experts @jsrailton concerning major new @citizenlab report & @Meta enforcement https://twitter.com/...
@howelloneill Patrick Howell O'Neill on x
Gleicher is a co-author on the big Facebook report. Here he helps map out what they're calling the Surveillance Attack Chain. Very useful illustration of how the industry is bigger than the small slice the public has focused in on. https://twitter.com/...
@arawnsley Adam Rawnsley on x
Big news: Meta ID'ed and took action against 7 mercenary surveillance companies. One of them, the Israeli-Macedonian firm Cytrox, hacked the iPhones of Egyptian targets, including one already infected with NSO Group's Pegasus malware. @citizenlab https://www.thedailybeast.com/ ..…
@bing_chris Chris Bing on x
Facebook exposes mercenary spy firms that targeted 50,000 people https://www.reuters.com/...
@evacide Eva on x
What do I think Meta should do next about the surveillance-for-hire industry? I think they should sue their pants off.
@w7voa Steve Herman on x
About 50,000 @Facebook users being alerted they may have been hacking targets by surveillance companies working for government agencies or private clients. https://about.fb.com/...
@ngleicher Nathaniel Gleicher on x
3/ We're also alerting about 50,000 people in 100+ countries that we believe were targeted by these firms.
@tomgara Tom Gara on x
“we took action against seven different surveillance-for-hire entities. They provided services across all three phases of the surveillance chain to indiscriminately target people in over 100 countries” https://about.fb.com/...
@jsrailton John Scott-Railton on x
4/ Cytrox has an EU footprint, & is part of Intellexa... which also brags of being regulated within the EU. Hello, regulators? Also, their CEO seems to think he's spyware's answer to Steve Jobs. They are about to have a horrid weekend for another reason: @meta's enforcement... ht…
@blackamazon @blackamazon on x
This sucks and no they did not warn everyone https://twitter.com/...
@agreendcbike Antoine McGrath on x
It's a relief to see heavyweights drawing the line on spyware. A rightly earned nod to Meta today Vulnerabilities need to be patched not exploited, if the ‘good guys’ use it so will the bad As always amazing research @citizenlab @billmarczak https://twitter.com/...
@carolafrediani Carola Frediani on x
Meta disrupted 7 ‘surveillance-for-hire’ networks and alerted 50,000 users. These surveillance groups targeted, spied on and at times attempted to exploit users in 100 countries https://about.fb.com/...
@skirchy Stephanie Kirchgaessner on x
One of Facebook's messages here is: great that everyone is hearing about NSO Group. They're not the only ones. https://twitter.com/...
@howelloneill Patrick Howell O'Neill on x
Citizen Lab has a new report out on the hacker-for-hire firm Cytrox: https://citizenlab.ca/... Cytrox is part of the Intellexa alliance of intelligence firms created explicitly to compete with industry giant NSO Group. I scooped that here a few years back: https://gizmodo.com/...
@jsrailton John Scott-Railton on x
5/ Let's talk about @Meta's massive enforcement action today. Starting with #Cytrox. They are swinging hard: ✅sent a cease & desist letter ✅killed 100s of accounts ✅notified targets globally ✅are dropping 100s of Cytrox indicators But this is just the appetizer... https://twitter…
@davidakaye David Kaye on x
big @meta report on threats from private #spyware industry, with this key point for USG & global policymakers: “NSO is only one piece of a much broader global cyber mercenary industry.” https://about.fb.com/...
@jsrailton John Scott-Railton on x
13/ The @meta notifications are a big deal. How big? ~50k targets 100+ countries Hear that sound? That's #surveillance4hire customers' stomaches churning as they wonder this will come back on them. https://twitter.com/...
@davidagranovich David Agranovich on x
1/ Today we released our research into the Surveillance-for-Hire industry. It includes 7 enforcements against surveillance entities from India, Israel, China, and North Macedonia and recommendations for holding this industry accountable. 🧵: https://about.fb.com/...
@jsrailton John Scott-Railton on x
15/ Slowing the harm from #surveillance4hire requires hitting hard, but systematically. It's great to see big platforms like @meta rock these mercenary spooks' world. Next key ingredient? Serious regulatory scrutiny, lawmaking & oversight are urgently needed. https://twitter.com/…
@joyce_karam Joyce Karam on x
One surveillance co., Cytrox, busted by Facebook is based in N Macedonia was hired by 10 Gov.: 1- Egypt 2- Armenia 3- Greece 4- Saudi Arabia 5- Oman 6- Colombia 7- Ivory Coast 8- Vietnam 9- The Philippines 10- Germany https://www.washingtonpost.com/ ...
@anthony Anthony DeRosa on x
Here is the Facebook (Meta) statement on the action: https://about.fb.com/...
@jckichen @jckichen on x
For every firm written about or technically compromised, there will be many more operating amidst the noise of criminal and state actors, likely more and more indistinguishable based on either targeting or technology. https://twitter.com/...
@zackwhittaker Zack Whittaker on x
The ban aims to stop the groups from using Facebook, Instagram, etc. to send malicious links to victims. Meta says it's notified around 50,000 people that they were targets of the seven groups. https://techcrunch.com/...
@iblametom Thomas Brewster on x
Another one of the companies named and shamed by Facebook, as well as being thrown off its apps, is Cobwebs Technologies. It has contracts with the DHS and IRS. I asked Facebook whether it was worried about upsetting US investigations: https://www.forbes.com/...
@anthony Anthony DeRosa on x
Spies for hire are secretly targeting journalists, human rights activists and political dissidents on behalf of corporations and governments to an extent not previously understood, Facebook's parent company says in a new report https://www.nbcnews.com/...
@iblametom Thomas Brewster on x
The second was Cytrox, a mysterious company once acquired by surveillance “alliance” Intellexa. The chief of that company once showed off a van that could hack into WhatsApp messages from hundreds of meters away. https://www.forbes.com/...
@washingtonpost @washingtonpost on x
Facebook is warning 50,000 users they may have been victims of private spyware https://www.washingtonpost.com/ ...
@zackwhittaker Zack Whittaker on x
New: Meta has banned 7 surveillance-for-hire outfits from its platforms, including Cytrox, a spyware maker that Citizen Lab says hacked into the iPhones of a politician and a journalist. https://techcrunch.com/...

Chronicles