Hacking Meduza: Pegasus spyware used to target Putin’s critic
1 of 4
https://www.accessnow.org/publication/hacking-meduza-pegasus-spywa...
Hacking Meduza: Pegasus spyware used to target
Putin’s critic
Natalia Krapiva @natynettle
An investigation by Access Now and the Citizen Lab at the Munk School of Global Affairs at the
University of Toronto (the Citizen Lab) has revealed that the iPhone of journalist Galina
Timchenko, head of Meduza, a leading Russian independent media outlet based in Latvia, has been
infected with Israeli firm NSO Group’s Pegasus spyware. The spyware attack took place two weeks
after the Russian government declared Meduza an “undesirable organization” for its critical
coverage of Vladimir Putin’s regime and the war in Ukraine. At the same time, some European
political leaders were publicly arguing for surveillance of all Russians in exile. This is the first
documented case of a Pegasus infection of a Russian journalist.
•
•
•
•
•
What happened
Russian independent media under attack
Who is behind this Pegasus attack?
Spyware violates human rights and international humanitarian law
Call for action
// What happened
On June 22, 2023, Timchenko, co-founder, CEO, and publisher of Meduza, received a notification
from Apple that state-sponsored attackers may be targeting her iPhone. The next day, Meduza’s
Chief Technology Officer contacted Access Now to check the phone for traces of spyware. Access
Now, with forensic assistance from the Citizen Lab, tested the device, and discovered that it had
been infected with Pegasus spyware on or around February 10, 2023, with the infection likely
lasting several days or weeks after that. At the time of the infection, Timchenko, who lives in Latvia,
was in Berlin, attending a private gathering organized by Redkollegia with other members of
Russian independent media living in exile to discuss the legal risks of “undesirable” and “foreign
agent” designations.
The Pegasus attack was conducted within the larger context of attacks against Meduza and other
Russian independent media organizations, at home and in exile.
Timchenko and her colleagues founded Meduza in 2014, after the owner of Lenta.ru removed her
as the chief editor for publishing an interview with the head of a Ukrainian nationalist group. The
organization chose to base Meduza in Latvia, relying on digital technologies to reach audiences
inside Russia. The publication became one of the first independent media outlets run by Russian
journalists in exile to launch a mobile app as a means of circumventing Russian censorship.
Meduza’s critical coverage did not, however, go unnoticed by Putin’s regime. In 2019, Russian
police arrested Meduza journalist Ivan Golunov on fabricated drug charges. After public outcry,
Golunov was subsequently released, and the police officers involved were sent to prison for the
unlawful arrest. In 2021, the Russian government designated Meduza a “foreign agent,” a move
condemned by the E.U. and media freedom organizations, among others. In March 2022, due to
Meduza’s critical coverage of Russia’s full-scale invasion of Ukraine and condemnation of the war,
7/5/2024, 3:46 PM