Hack-for-hire group targeted climate activists behind #ExxonKnew campaign.

The hackers, dubbed ‘Dark Basin’, went after thousands of individuals and hundreds of institutions, a report finds.

A global hack-for-hire group extensively targeted American activists campaigning against ExxonMobil for withholding information about the climate crisis, according to a new report. 

The hackers, dubbed “Dark Basin”, went after thousands of individuals and hundreds of institutions on six continents, including advocacy organizations, journalists, elected officials and businesses, said the Citizen Lab, a Toronto-based digital espionage research group. 

The Citizen Lab links the hacking efforts to BellTroX InfoTech Services, an Indian company which has denied any wrongdoing. The research report said: “The extensive targeting of American nonprofits exercising their first amendment rights is exceptionally troubling.” 

“Everyone is familiar with getting phishing and spam emails in their mailbox all the time,” said John Scott-Railton, a senior researcher at the Citizen Lab. “The difference is that in this case the people behind them are not just faceless cyber-criminals looking to steal your Gmail account and use it to spam your friends about time shares and penis pills. This is people who have been sent after you with specific objectives to get information that is going to be used to harm you.” 

Scott-Railton said the hack-for-hire industry was growing and becoming more accessible for adversaries to use against each other in disputes, whether they are between companies and governments, or between companies, or are targeting non-profits and reporters.

US federal prosecutors are investigating and have charged one Israeli man in connection with the case, according to the New York Times.

The Citizen Lab said it did not have strong evidence pointing to a client for the hackers and did not accuse Exxon of wrongdoing.

An Exxon spokesman said the company has no knowledge of or involvement in the hacking activities outlined and charged that the Citizen Lab receives financial support from “anti-fossil fuel groups”. 

The organizations that consented to be named in the report include the Rockefeller Family Fund, the Climate Investigations Center, Greenpeace, the Center for International Environmental Law, Oil Change International, Public Citizen, the Conservation Law Foundation, the Union of Concerned Scientists and 350.org. The attacks spanned from 2016 through 2017. 

In January 2016, environmental organizations and funders met to discuss the #ExxonKnew campaign. A private email inviting attendees was then leaked from an unknown source to reporters. 

The targeting was well-informed, according to the Citizen Lab. Some phishing emails were made to look like Google News alerts with stories about Exxon. Others appeared to be colleagues sharing Dropbox documents about the campaign. 

Kert Davies, founder of the Climate Investigations Center, said he received one phishing attempt that looked like an email from a Washington-based reporter. 

“We don’t know who paid for it, the most important thing, who was contracting with the Indian company to gather this intelligence,” Davies said. 

He added: “It is nothing new. Any time I’ve done work in the past 25 years doing this stuff that starts to have an impact on a company, there is blowback.” 

11 June 2020

The Guardian