Jurre van Bergen

Just like CitizenLab, I was tracking Discover-Tech, the ad company providing ADINT services on the side, to both Bindecy and Candiru. Today at Threatnotify, we're publishing a breakdown of data from their ad bids and S3 bucket: www.threatnotify.org/projects/dt/ & github.com/Threatnotify...

As @donncha.is & @jurrevanbergen.nl wrote on former Twitter, Amnesty Security Lab was also tracking the ad-based spyware facilitator Discover-Tech. Jurre now published an analysis of ad bidding data 2025-26 and a world-readable s3 bucket: www.threatnotify.org/projects/dt/ github.com/Threatnotify...

⚠️ Boyd wouldn't confirm to @kimzetter.bsky.social how many products the combined companies possess: "together they now have between five and 10." ➡️ However, REDLattice's Investor Presentation (SEC filing from Sept 29) DOES list specifically 8 products:

David Berman having Three 6 Mafia on his favorite 2005 album list is *mind blown*

We are honored to be shortlisted for the IJ4EU Impact Awards 2026 | @ecpmf.bsky.social, for The Great Firewall Export: China's Censorship Technology Goes Global. A cross-border investigation by eight organizations. What we found, in a thread. 🧵 #IJ4EUImpactAward

1/ Today @milenkowski.bsky.social from @sentinellabs.bsky.social and I are publishing a project we've been working on over the past few months. We found suspected China- and India-linked espionage actors independently targeting the same victim: #Balochistan Police in #Pakistan. s1.ai/spy2flags

Committee to protect "some' journalists more like it

Did DoD just admit in a court filing that it used xAI's Grok Gov Model to hit the girls' school on the first day of the Iran war? Based on some passages flagged by @rgoodlaw.bsky.social in DoD's recent filing in NAACP's case against X, it looks like it did 1/

Tomorrow is my last day at Amnesty International's Security Lab. I left to do my own thing. More on that soon!! For now i'm going on a sabbatical for a couple months.

Scoop: Central Command is getting reports that military personnel are being targeted using commercially available location data. Few details available, but it’s a sign that the tech industry’s advertising-surveillance complex is having consequences on the battlefield. www.reuters.com/business/med...

Vor drei Jahren hat die Staatsanwaltschaft vier Manager von FinFisher angeklagt. Die Ermittler werfen dem Münchener Unternehmen vor, ihren Staatstrojaner ohne Genehmigung an die Türkei verkauft zu haben. Seitdem ist nichts passiert. Das Gericht prüft und prüft. netzpolitik.org/2023/unsere-...

Spoke to Wired Greece about Predator and their new infection vector through online advertisement, Aladdin: wired.com.gr/article/i-an...

The Chinese Government Just Got the World’s Largest Digital Rights Conference Canceled www.wired.com/story/the-ch...

Following our April 29 announcement, we believe it's important to be transparent about the context that led to the decision. We want to explain, where we can, why this was made on such short notice, only days before we were set to host RightsCon. Read: www.rightscon.org/rc26-stateme...

Intellexa had a secret US partner with government ties that fed it Android and iOS exploits on a revenue sharing scheme 🫥 via @jurrevanbergen.nl www.antenna.gr/ereynes/arti...

NEW: Researchers have have exposed yet another spyware maker that develops fake Android apps for its government customers. The apps were pushed with help of telecom providers. And it's yet another Italian company: IPS, which until now was only known to make traditional wiretapping systems.

@interseclab.bsky.social published new research and looking at the supply chain based on the Geedge Networks leak. MADLink - A Taiwanese Vestige in the Geedge Supply Chain. interseclab.org/research/mad...

“🇬🇷Greek newspaper @tovimagr.bsky.social has reported that a previously undisclosed memorandum of cooperation was signed between a consortium involving the spyware-linked company Intellexa and a technology unit of Greece’s National Intelligence Service.” www.dnews.gr/eidhseis/new...

Get me out of this reality wtf

WhatsApp told 200 users - mostly Italian - they installed phony version of the app containing spyware. Fake messaging app was created by spyware firm SIO. WhatsApp says attacks were "highly targeted" and result of social engineering. SIO works with the Italian govt. therecord.media/whatsapp-war...

Threat Actors are "Bringing Their Own Forensics" In a recent ClickFix campaign, we saw threat actors likely related to Interlock Ransomware, running Volatility (vol.py) directly on victim machines. Commonly a tool for defenders, the TAs are using it to:

lmao #sabu

I got this fixed, hurray!

Curious. Former head of the Dutch Intelligence Service. Rob Bertholee, joined Dataflow Security on the advisory board.

Really awful news. Rest in power Jason.

Blood boiling

When Zero-Knowledge Proofs Are Not Enough: Lessons from a Real-World Zero-Knowledge Authorization System, a.k.a Analysis and Vulnerabilities in zkLogin (eprint.iacr.org/2026/227) (1/n)

Bro wanted more money for knock off watches??

Don't tell North Korea!

Microsoft is handing over Bitlocker keys to law enforcement. www.forbes.com/sites/thomas...

www.theguardian.com/world/2026/j... "Spain’s highest criminal court has again shelved its investigation into the use of Pegasus software to target the mobile phones of senior Spanish ministers, including the prime minister, citing a chronic lack of cooperation from the Israeli authorities."

Goes to Palantir

It's only going to get worse isn't it?

Treasury said in an email that the removal "was done as part of the normal administrative process in response to a petition request for reconsideration." It added that each of the individuals had "demonstrated measures to separate themselves from the Intellexa Consortium." 😱

Gambazzi, Hamou and Harpaz, who previously were sanctioned in relation to Intellexa. Got removed from sanctions today. ofac.treasury.gov/recent-actio...

Previously unknown instructions & settings sheets for the SG-41 have been discovered in Czech archives! Thanks to Eugen Antal, Carola Dahlke & Robert Jahn who published them in Cryptologia. I've been working to bring these into Virtual SG-41 @tnmoc.bsky.social @cryptomuseum.bsky.social

The Pope involves himself in Italy's spy scandal and asks intel officials to respect people's privacy and not leak data and smear people with hacked data www.reuters.com/world/pope-t...

www.lemonde.fr/en/pixels/ar... It’s not just a problem in France #SpeirGorm #SpéirGhorm.

Found two Edge Group brochures for their IMSI-Catcher products that I haven't seen publicly before: github.com/DrWhax/edgeg...

One Laptop Per Child, 10 years later: "we find no significant effects on academic performance but some evidence of negative effects on grade progression... computer access significantly improved students’ computer skills but not their cognitive skills" www.nber.org/papers/w34495

It was one of a trio of reports about the spyware vendor over the course of a day, with additional evidence about further infections among the findings. via @timstarks.bsky.social cyberscoop.com/intellexa-re...

Interesting artefact in the uploaded JSKit code used by Intellexa from Google's Threat Intelligence Group. "//TODO: va bene solo per ios 15 perchè l'exploit è uguale per tutte le version 15.0.x infatti se inferiore a 15.1 restituisce sempre 15.0" - some italian.... cloud.google.com/blog/topics/...

Insikt Group researchers found new evidence of Predator's continued deployment in Iraq and Pakistan. New shell companies and other interconnected firms also discovered and suggest "expanding network footprint." therecord.media/intellexa-pr...