Loading story…
German authorities charged four people over the alleged sale of FinFisher/FinSpy surveillance software to Turkey without the export license required for dual-use spyware. The case grew out of a Munich prosecutors' investigation into whether the German spyware maker exported the tool illegally, after journalists and rights groups alleged that FinSpy had been delivered to Turkey despite Germany saying no export permits for such spyware had been issued since 2015.
The allegations stem from a 2017 campaign in which anti-government protesters in Turkey were reportedly targeted through fake Twitter accounts and malicious smartphone apps linked to FinSpy. Researchers and complainants said the spyware could give operators extensive access to victims' communications and device data, and organizations including Reporters Without Borders, Netzpolitik.org, GFF, and the European Center for Constitutional and Human Rights pushed for the investigation that ultimately led to charges.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
German authorities later brought charges against four individuals in connection with selling spyware to Turkey. This marked an escalation from the earlier investigation into alleged unauthorized exports tied to FinFisher spyware.
Munich public prosecutors began investigating whether FinFisher illegally exported spyware to Turkey without a BAFA permit. German authorities noted that no export permits for spying software had been issued since 2015, raising suspicion that any such export was unauthorized.
Reporters Without Borders, Netzpolitik.org, GFF/Society for Civil Rights, and the European Center for Constitutional and Human Rights filed a complaint alleging FinFisher exported surveillance software to Turkey without the required German authorization. The complaint followed media reporting linking the Turkish spyware campaign to FinSpy.
FinFisher acknowledged that its surveillance software had been sold to the German state of Bavaria. The disclosure identified Bavaria as an early known government customer of the company's spyware.
In 2017, spyware linked to FinFisher's FinSpy product was reportedly deployed against anti-government protesters in Turkey. The campaign used fake Twitter accounts and malicious smartphone apps to target CHP protesters opposing President Recep Tayyip Erdogan.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourceweb.archive.org
Open sourcedw.com
Open sourcedw.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that malware allegedly used by German authorities for lawful interception included capabilities far beyond court-permitted wiretapping. Analysis of samples released publicly after allegations by the Chaos Computer Club showed the spyware could perform **keylogging**, capture **screenshots**, record **audio**, remotely control infected systems, exfiltrate data, and download and execute additional files, raising concerns that its functionality exceeded Germany’s legal surveillance boundaries. ESET identified the sample as `Win32/R2D2.A` after finding the transmission string `C3PO-r2d2-POE` in the malware. The report noted anecdotal links to Bavarian contractor DigiTask but said binary analysis alone could not conclusively attribute the malware’s origin. It also argued that antivirus vendors should detect such software if it behaves maliciously, regardless of whether it was allegedly built for law enforcement, and highlighted broader legal and ethical tensions over government spyware and privacy protections.
Jun 29, 2026
A Greek court sentenced **four Intellexa executives** to **eight years in prison** for their role in the “**Predatorgate**” spyware scandal, which involved use of **Predator** spyware against **90+ public figures**. Prior investigations by **The Citizen Lab** and others documented Predator’s presence in Greece and confirmed infections on devices belonging to journalist **Thanasis Koukakis** and former Meta trust-and-safety manager **Artemis Seaford**, marking a rare case where executives at a mercenary spyware firm faced criminal conviction and prison time. In Italy, prosecutors in Rome and Naples confirmed via a technical report that journalist **Francesco Cancellato** and immigration activists **Giuseppe Caccia** and **Luca Casarini** showed traces consistent with **Paragon Solutions** spyware infections during the early hours of **2024-12-14**, suggesting a coordinated infection campaign. Italian authorities also inspected a Paragon spyware server used by the intelligence agency **AISI** and found evidence of operations against Caccia and Casarini but not against Cancellato, leaving attribution for Cancellato’s compromise unresolved; the case follows **WhatsApp** notifications to roughly **90** people warning they were targeted with Paragon spyware.
Jun 29, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026