Amazon Web Services (AWS) has shut down infrastructure and accounts linked to Israeli surveillance vendor NSO Group, Amazon said in a statement.

... "When we learned of this activity, we acted quickly to shut down the relevant infrastructure and accounts," an AWS spokesperson told Motherboard in an email.

Amnesty International published a forensic investigation on Sunday that, among other things, determined that NSO customers have had access to zero-day attacks in Apple's iMessage as recently as this year. As part of that research, Amnesty wrote that a phone infected with NSO's Pegasus malware sent information "to a service fronted by Amazon CloudFront, suggesting NSO Group has switched to using AWS services in recent months." The Amnesty report included part of the same statement from Amazon, showing Amnesty contacted the company before publication.

Citizen Lab, in a peer review of Amnesty's findings, said in its own post that the group "independently observed NSO Group begin to make extensive use of Amazon services including CloudFront in 2021."

CloudFront is a content delivery network (CDN) that allows customers, in this case NSO, to more quickly and reliably deliver content to users... CloudFront infrastructure was used in deployments of NSO's malware against targets, including on the phone of a French human rights lawyer, according to Amnesty's report. The move to CloudFront also protects NSO somewhat from researchers or other third parties trying to unearth the company's infrastructure.

... Amazon has previously remained silent on NSO using its infrastructure. In May 2020 when Motherboard uncovered evidence that NSO had used Amazon infrastructure to deliver malware, Amazon did not respond to a request for comment asking if NSO had violated Amazon's terms of service.