Report

- Amnesty International’s Security Lab documents a targeted digital surveillance campaign (late 2019–early 2020) against a Togolese human rights defender that attempted to deliver Android spyware (StealJob/FireStarter) and Windows spyware (YTY) via WhatsApp and malicious Office documents; the attacks were blocked. The report provides technical analysis (malware behavior, C2 protocols, exploitation of CVE-2017-0199), exposed attacker infrastructure and logs (short URL service bulk.fun, Nextcloud and Digital Ocean C2 servers), screenshots linking the Donot Team toolset to the IP 122.160.158.3 associated with Innefu Labs, a list of IOCs, and human-rights-focused recommendations for the company and governments.