Cybercrime gangs like the notorious Lazarus group and spyware vendors like Israel's NSO should be considered cyber mercenaries - and become the subject of a concerted international response - according to a Monday report from Delhi-based think tank Observer Research Foundation.
The modern equivalent is those who carry out their operations using information technology and networks - hence the term cyber mercenaries.
Such groups have been noted and studied by groups like Citizen Lab and Amnesty International since the early 2010s but are often considered mere criminals.
Timur argued that Lazarus Group earned the dubious title of cyber mercenary by working to develop and distribute malware on behalf of the North Korean government.
She asserted that NSO Group joined the club by peddling its Pegasus spyware to governments willing to purchase and deploy it despite being a legitimate business.
Other cyber mercenary operations offer hackers-for-hire.
They don't require a human resource department, training, or other personnel costs.
Nations that can't afford an offensive cyber-ops crew may therefore hire cyber mercenaries to get into the game.
While some work has been done to curb such actors, Timur suggested more needs to done.
She called for legislation that aligns the use of intelligence and digital forensic tools with human rights obligations.
She also states that standards must be set so that acts conducted in the name of national security also respect human rights declarations.
The software was used to target government officials, journalists, businesspeople, activists, academics, and other targets that posed little plausible threat to safety - but may have been irritants to politicians.
The report concludes by calling for citizens to demand accountability from governments and businesses who engage cyber mercenaries.
Timur noted that civil society groups have taken action through lawsuits to demand better transparency.
This Cyber News was published on go.theregister.com. Publication date: Wed, 13 Dec 2023 06:43:28 +0000