A recent investigation into how Pegasus spyware is being used to monitor civil rights agencies, journalists, and government figures worldwide is being abused in a new wave of cyberattacks. 

Pegasus is a surveillance device provided with the aid of using the NSO Group. While marketed as a software program for preventing crime and terrorism, a probe into the adware caused allegations that it’s far getting used in opposition to innocents, along with human rights activists, political activists, lawyers, journalists, and politicians worldwide.

Israel-primarily based totally NSO Group denied the findings of the investigation, performed with the aid of using Amnesty International, Forbidden Stories, and several media outlets.

Apple has in view that patched a zero-day vulnerability used by Pegasus, a discovery made collectively with Citizen Lab.

Now, cybercriminals unconnected to Pegasus are trying to capitalize on the damning record with the aid of using promising people a manner to ‘defend themselves in opposition to such surveillance — however are secretly deploying their very own manufacturers of malware, instead.

On Thursday, researchers from Cisco Talos stated that dangerous actors are masquerading as Amnesty International and feature installation a faux area designed to impersonate the organization’s valid website.

This factors to an ‘antivirus’ tool, “AVPegasus,” that guarantees to defend PCs from the adware

However, in keeping with Talos researchers Vitor Ventura and Arnaud Zobec, the software program consists of the Sarwent Remote Access Trojan (RAT).

The dom7ain names related to the marketing campaign are amnestyinternationalantipegasus[.]com, amnestyvspegasus[.]com, and antipegasusamnesty[.]com.

Written in Delphi, Sarwent installs a backdoor onto machines while achieved and is likewise capable of leverage a faraway computer protocol (RDP) to hook up with an attacker-managed command-and-control (C2) server.

The malware will try to exfiltrate credentials and is likewise capable of download and execute similarly malicious payloads.

The UK, US, Russia, India, Ukraine, the Czech Republic, Romania, and Colombia are the maximum focused nations to date. Talos believes the cyber attacker in the back of this marketing campaign is a Russian speaker who has operated different Sarwent-primarily based totally assaults over 2021.

“The marketing campaign objectives individuals who are probably worried that they’re focused through the Pegasus spyware,” Talos says. “This concentrated on increases problems of feasible country involvement, however, there are inadequate records to be had to Talos to make any willpower there. It is feasible that that is without a doubt a financially prompted actor trying to leverage headlines to advantage new access.”