Loading story…
Cellebrite has launched its Tactical Extraction Kit (C-TEK), a backpack-sized digital-forensics platform for military and intelligence personnel to collect and analyze data at the point of capture. The generally available kit combines ruggedized hardware and power supplies with Cellebrite Inseyets and Digital Collector software, enabling field triage and selective extraction from phones, SIM cards, computers, tablets, drones, and portable media.
Cellebrite said C-TEK can rapidly surface contacts, communications, chats, media, location history, and search history without requiring extensive forensic expertise; its component technologies have already been field-tested by military customers. The company has not disclosed its device-access methods, and capabilities vary by device operating system and encryption, including whether powered-off devices can be accessed. The launch renews privacy and human-rights concerns that mobile-device extraction technology could be used against dissidents or activists, while Cellebrite says it enforces ethical-use guidelines.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Cellebrite launched the backpack-sized Tactical Extraction Kit (C-TEK), a portable digital-forensics system for military and intelligence personnel. The kit combines ruggedized hardware, Inseyets, and Digital Collector to triage and extract data from devices including phones, SIM cards, computers, tablets, and drones.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedefensescoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Citizen Lab** reported forensic evidence indicating Kenyan authorities used **Cellebrite** phone-extraction technology on the personal device of Kenyan activist and prospective presidential candidate **Boniface Mwangi** following his arrest amid mass protests. After his phone was returned, Mwangi observed that password protection had been removed, prompting him to submit the device for analysis; researchers concluded the artifacts were consistent with Cellebrite-enabled access intended to extract data from the handset, exposing sensitive personal and political communications. The investigation identified traces of an application associated with Cellebrite tooling, including an app artifact appearing as `com.client.appA`, and framed the case as part of a broader pattern in which journalists and civil-society figures have allegedly been targeted with Cellebrite-assisted extractions while detained. Citizen Lab argued that Cellebrite’s stated safeguards—such as ethics review processes—have not prevented repeated alleged misuse in multiple countries, and warned that sales to security services with documented human-rights concerns increase the risk of abuse against activists and dissidents.
Jun 29, 2026
Russian authorities used **Cellebrite UFED** phone-forensics technology to access the iPhone of jailed opposition figure **Andrey Pivovarov** in June 2021, months after Cellebrite said it had ended sales and services to Russian government customers over human rights concerns. A **Citizen Lab** investigation, supported by forensic evidence from Pivovarov’s device and Russian court records, found investigators extracted data including **WhatsApp** and **Telegram** messages and searched for political terms and opposition figures; authorities reportedly could not unlock his MacBook. The findings renewed scrutiny of how surveillance and forensic tools remain usable after vendors cut ties with government clients. Researchers said Cellebrite’s legacy architecture and offline functionality allowed older systems to keep operating without vendor support, and warned that data taken from Pivovarov’s phone may also have aided surveillance of other dissidents, including **Anastasiya Burakova**, who was later targeted in a hacking campaign linked to Russia’s **FSB**. Cellebrite said any post-March 2021 use in Russia was **unauthorized**, involved legacy hardware, and would now be ineffective against modern devices.
Jul 12, 2026
An investigation by the University of Toronto’s **Citizen Lab**, published in coordination with **OCCRP**, reported that Jordanian authorities used **Cellebrite** digital forensic tools to gain nonconsensual access to the phones of domestic activists and human rights defenders. Based on forensic analysis of seized-and-returned devices and corroborating court records, Citizen Lab assessed with **“high confidence”** that multiple devices were subjected to Cellebrite forensic extraction during cases tied to enforcement actions under Jordan’s cybercrime framework, including proceedings under the **2023 Cybercrime Law**. Citizen Lab documented at least **seven** cases between late 2023 and mid-2025 (four supported by device forensics and three by court records), involving **three iPhones and one Android** in the forensically analyzed set, and said it is aware of **dozens** of additional instances. The report states the extractions occurred while individuals were interrogated or detained for speech critical of Israel’s campaign in Gaza, and it argues Cellebrite use against civil society in Jordan appears broader and longer-running, with forensic indicators suggesting deployment dating back to **at least 2020**; Citizen Lab called on **Cellebrite** to review its Jordan-related customer use in light of alleged rights abuses.
Jun 29, 2026