Loading story…
Russian authorities used Cellebrite UFED phone-forensics technology to access the iPhone of jailed opposition figure Andrey Pivovarov in June 2021, months after Cellebrite said it had ended sales and services to Russian government customers over human rights concerns. A Citizen Lab investigation, supported by forensic evidence from Pivovarov’s device and Russian court records, found investigators extracted data including WhatsApp and Telegram messages and searched for political terms and opposition figures; authorities reportedly could not unlock his MacBook.
The findings renewed scrutiny of how surveillance and forensic tools remain usable after vendors cut ties with government clients. Researchers said Cellebrite’s legacy architecture and offline functionality allowed older systems to keep operating without vendor support, and warned that data taken from Pivovarov’s phone may also have aided surveillance of other dissidents, including Anastasiya Burakova, who was later targeted in a hacking campaign linked to Russia’s FSB. Cellebrite said any post-March 2021 use in Russia was unauthorized, involved legacy hardware, and would now be ineffective against modern devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In response to the report, Cellebrite said any use of its legacy hardware in Russia after March 2021 was unauthorized and unsupported, and it argued such hardware would now be ineffective against modern devices. The statement directly addressed the allegations raised by Citizen Lab and news outlets.
On 2026-06-25, multiple outlets reported Citizen Lab's findings that Russian authorities used Cellebrite technology against dissident Andrey Pivovarov after the company had cut off Russian government customers. The report argued that offline functionality and legacy architecture made it difficult for Cellebrite to effectively disable problematic customers.
In March 2021, Cellebrite announced that it would stop sales and services to Russian government customers over human rights concerns. Later reporting said Russian authorities nonetheless retained the ability to use legacy UFED systems.
On 2022-10-21, Haaretz reported that Russia's Investigative Committee was still using Cellebrite mobile extraction tools against detainees despite the company's 2021 halt of Russian operations. The report said online-accessible Russian documents indicated ongoing use of the Israeli firm's technology.
Around 2021-06-17, while Andrey Pivovarov was in custody, Russian authorities used Cellebrite UFED technology to extract data from his iPhone. Forensic evidence and court records indicated the extraction included app data such as WhatsApp and Telegram messages and was used in the political case against him.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebloomberg.com
Open sourcetherecord.media
Open sourcehaaretz.com
Open sourcecellebrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Citizen Lab** reported forensic evidence indicating Kenyan authorities used **Cellebrite** phone-extraction technology on the personal device of Kenyan activist and prospective presidential candidate **Boniface Mwangi** following his arrest amid mass protests. After his phone was returned, Mwangi observed that password protection had been removed, prompting him to submit the device for analysis; researchers concluded the artifacts were consistent with Cellebrite-enabled access intended to extract data from the handset, exposing sensitive personal and political communications. The investigation identified traces of an application associated with Cellebrite tooling, including an app artifact appearing as `com.client.appA`, and framed the case as part of a broader pattern in which journalists and civil-society figures have allegedly been targeted with Cellebrite-assisted extractions while detained. Citizen Lab argued that Cellebrite’s stated safeguards—such as ethics review processes—have not prevented repeated alleged misuse in multiple countries, and warned that sales to security services with documented human-rights concerns increase the risk of abuse against activists and dissidents.
Jun 29, 2026
An investigation by the University of Toronto’s **Citizen Lab**, published in coordination with **OCCRP**, reported that Jordanian authorities used **Cellebrite** digital forensic tools to gain nonconsensual access to the phones of domestic activists and human rights defenders. Based on forensic analysis of seized-and-returned devices and corroborating court records, Citizen Lab assessed with **“high confidence”** that multiple devices were subjected to Cellebrite forensic extraction during cases tied to enforcement actions under Jordan’s cybercrime framework, including proceedings under the **2023 Cybercrime Law**. Citizen Lab documented at least **seven** cases between late 2023 and mid-2025 (four supported by device forensics and three by court records), involving **three iPhones and one Android** in the forensically analyzed set, and said it is aware of **dozens** of additional instances. The report states the extractions occurred while individuals were interrogated or detained for speech critical of Israel’s campaign in Gaza, and it argues Cellebrite use against civil society in Jordan appears broader and longer-running, with forensic indicators suggesting deployment dating back to **at least 2020**; Citizen Lab called on **Cellebrite** to review its Jordan-related customer use in light of alleged rights abuses.
Jun 29, 2026
Cellebrite said it has suspended the use of some of its digital forensic products by certain customers in Serbia after Amnesty International reported that Serbian police and intelligence services allegedly used the technology to unlawfully extract data from the phones of activists and journalists. Amnesty said its December 2024 investigation found that authorities used mobile device extraction tools outside legally sanctioned procedures and, in some cases, that targeted phones were later infected with spyware. The dispute has intensified scrutiny of Serbia’s treatment of civil society and independent media, with Amnesty arguing that the surveillance activity occurred amid anti-government protests and a broader pattern of pressure on government critics. Amnesty welcomed Cellebrite’s move but called on the company to strengthen human-rights due diligence and urged a halt to exports of surveillance and digital forensics technology to Serbia until effective independent oversight is in place.
Jul 24, 2026