Mexican spyware campaign targeted lawyers in high-profile murder case

Lawyers representing the families of murder victims in a case many believe is connected to a former Mexican governor were targeted by militarized spyware only sold to governments, according to a new report released Wednesday.

Researchers at the University of Toronto’s Citizen Lab found attempts to infect lawyers Karla Micheel Salas and David Peña with the NGO Group’s Pegasys software. The software is used to monitor law enforcement and espionage targets. The incident expands the number of “abusive, improper targeting” of Mexican human rights and opposition leaders investigated by Citizen Lab to 21 cases. 


Salas and Peña represent three of five families of victims of murder and sexual assault in Mexico City, which took the lives of journalists Nadia Vera and Rubén Espinosa and three of Vera’s flat-mates. Vera and Espinosa had published work critical of ex-Veracruz governor Javier Duarte, who allegedly once tried to buy up every copy of a magazine featuring an “unflattering” photo Espinosa had taken of Duarte. 

Duarte had made what many believed to be threats against journalists in the weeks leading up to the murders. 

The case was ruled a robbery, though opponents of the theory claim no valuables were stolen. 

Citizen Lab, which investigates hacking against human rights groups, journalists and activists, has detailed 21 cases of the use of NGO Group products in Mexico against government opposition officials, human rights groups, journalists and now lawyers. The attempt to infect the lawyers uses attack infrastructure seen in previous attacks. 

Peña and Salas were targeted with malicious text messages containing links to the spyware. 

“[W]e fully expect to find more cases of the abuse of NSO Group technology, not just in Mexico but in other jurisdictions, where corrupt public officials with access to their spyware illegitimately turn it on those who present obstacles to their unscrupulous aims,” wrote Ronald Deibert, director of Citizen Lab, in a press release announcing their findings. 

See all Hill.TV See all Video

Most Popular

Load more


See all Video