Amnesty International has uncovered a targeted digital attack campaign against a prominent human rights defender (HRD) in Togo. The HRD was targeted in late 2019 and early 2020 with both Android and Windows spyware…

The Amnesty International Security Lab investigation found that the spyware used in these attack attempts is tied to an attacker group known in the cybersecurity industry as the Donot Team, previously connected to attacks in India, Pakistan and neighbouring countries in South Asia...

Amnesty International has also identified apparent links between the Donot Team spyware and an Indian cybersecurity company, Innefu Labs Pvt. Ltd., which advertises digital security, data analytics, and predictive policing services to law enforcement and armed forces… There is no sufficient evidence to indicate whether Innefu Labs had any direct involvement in the targeting of the HRD in Togo. Although the Innefu Labs IP address is connected to both the spyware distribution website and to the Donot Team spyware, Innefu Labs may not necessarily know how any third parties are using these spyware tools.

This case highlights the threat “hacker-for-hire”-type attacks pose to human rights defenders and to civil society globally. “Hacker-for-hire” attacks are offensive cyber operations performed by a threat actor (“a hacker”) normally on behalf of paying customers. These customers may include domestic government agencies, foreign governments or commercial entities... Innefu Labs should urgently conduct an external audit and publish the findings of the audit regarding the apparent links between Innefu Labs and the spyware infrastructure used in the attacks against the HRD from Togo…

Further, authorities in both India and Togo should impose an immediate moratorium on the sale, transfer, and use of spyware technology until there is a robust human rights-compliant regulatory framework in place.

[A statement from Innefu Labs to Amnesty International reads] "At the outset we firmly deny the existence of any link whatsoever between Innefu Labs and the spyware tools associated with the ‘Donot Team’ group and the attacks against a Human Rights Defender in Togo...

We believe that the link between Innefu Labs, Donot group and the attack on the HRD in Togo is misplaced and an attempt is being made to stretch the truth. We deny all allegations set out in your letter. We are not aware of any use of our IP address for the alleged activities."