Pakistan police arrest top Barelvi leader who led Asia Bibi protests

Jun 27: Alittle-known Indian IT firm offered its hacking services to help clients spy on more than 10,000 email accounts over a period of seven years.

New Delhi-based BellTroX InfoTech Services targeted government officials in Europe, gambling tycoons in the Bahamas, and well-known investors in the United States including private equity giant KKR and short seller Muddy Waters, according to three former employees, outside researchers, and a trail of online evidence.

Aspects of BellTroX's hacking spree aimed at American targets are currently under investigation by U.S. law enforcement, five people familiar with the matter told Reuters. The U.S. Department of Justice declined to comment.

Reuters does not know the identity of BellTroX's clients. In a telephone interview, the company's owner, Sumit Gupta, declined to disclose who had hired him and denied any wrongdoing.

Muddy Waters founder Carson Block said he was "disappointed, but not surprised, to learn that we were likely targeted for hacking by a client of BellTroX." KKR declined to comment.

Researchers at internet watchdog group Citizen Lab, who spent more than two years mapping out the infrastructure used by the hackers, released a report that BellTroX employees were behind the espionage campaign.

"This is one of the largest spy-for-hire operations ever exposed," said Citizen Lab researcher John Scott-Railton.

Although they receive a fraction of the attention devoted to state-sponsored espionage groups or headline-grabbing heists, "cyber mercenary" services are widely used, he said. "Our investigation found that no sector is immune."

A cache of data reviewed by Reuters provides insight into the operation, detailing tens of thousands of malicious messages designed to trick victims into giving up their passwords that were sent by BellTroX between 2013 and 2020. The data was supplied on condition of anonymity by online service providers used by the hackers after Reuters alerted the firms to unusual patterns of activity on their platforms.

The data is effectively a digital hit list showing who was targeted and when. Reuters validated the data by checking it against emails received by the targets.

On the list: judges in South Africa, politicians in Mexico, lawyers in France and environmental groups in the United States. These dozens of people, among the thousands targeted by BellTroX, did not respond to messages or declined comment.

Reuters was not able to establish how many of the hacking attempts were successful.

BellTroX's Gupta was charged in a 2015 hacking case in which two U.S. private investigators admitted to paying him to hack the accounts of marketing executives. Gupta was declared a fugitive in 2017, although the U.S. Justice Department declined to comment on the current status of the case or whether an extradition request had been issued.

Speaking by phone from his home in New Delhi, Gupta denied hacking and said he had never been contacted by law enforcement. He said he had only ever helped private investigators download messages from email inboxes after they provided him with login details.

"I didn't help them access anything, I just helped them with downloading the mails and they provided me all the details," he told Reuters. "I am not aware how they got these details but I was just helping them with the technical support."

Reuters could not determine why the private investigators might need Gupta to download emails. Gupta did not return follow-up messages. Spokesmen for Delhi police and India's foreign ministry did not respond to requests for comment.

HOROSCOPES AND PORNOGRAPHY

Operating from a small room above a shuttered tea stall in a west-Delhi retail complex, BellTroX bombarded its targets with tens of thousands of malicious emails, according to the data reviewed by Reuters. Some messages would imitate colleagues or relatives; others posed as Facebook login requests or graphic notifications to unsubscribe from pornography websites.

Fahmi Quadir's New York-based short selling firm Safkhet Capital was among 17 investment companies targeted by BellTroX between 2017 and 2019. She said she noticed a surge in suspicious emails in early 2018, shortly after she launched her fund.

Initially "it didn't seem necessarily malicious," Quadir said. "It was just horoscopes; then it escalated to pornography."

Eventually the hackers upped their game, sending her credible-sounding messages that looked like they came from her coworkers, other short sellers or members of her family. "They were even trying to emulate my sister," Quadir said, adding that she believes the attacks were unsuccessful.

U.S. advocacy groups were also repeatedly targeted. Among them were digital rights organizations Free Press and Fight for the Future, both of whom have lobbied for net neutrality. The groups said a small number of employee accounts were compromised, but the wider organizations' networks were untouched. The spying on those groups was detailed in a report by the Electronic Frontier Foundation in 2017, but has not been publicly tied to BellTroX until now.

Timothy Karr, a director at Free Press, said his organization "sees an uptick in breach attempts whenever we're engaged in heated and high-profile public policy debates." Evan Greer, deputy director of Fight for the Future, said: "When corporations and politicians can hire digital mercenaries to target civil society advocates, it undermines our democratic process."

While Reuters was not able to establish who hired BellTroX to carry out the hacking, two former employees said the company and others like it were usually contracted by private investigators on behalf of business rivals or political opponents.

Bart Santos of San Diego-based Bulldog Investigations was one of a dozen private detectives in the United States and Europe who told Reuters they had received unsolicited advertisements for hacking services out of India - including one from a person who described himself as a former BellTroX employee. The pitch offered to carry out "data penetration" and "email penetration."

Santos said he ignored those overtures, but could understand why some people didn't. "The Indian guys have a reputation for customer service," he said.

Beijing, Feb 18: Police in China have arrested a prominent activist who had been a fugitive for weeks and criticised President Xi Jinping's handling of the coronavirus epidemic while in hiding, a rights group said Tuesday.

Anti-corruption activist Xu Zhiyong was arrested on Saturday after being on the run since December, according to Amnesty International.

China's ruling Communist Party has severely curtailed civil liberties since Xi took power in 2012, rounding up rights lawyers, labour activists and even Marxist students.

The death this month of a whistleblowing doctor who was reprimanded by police for raising the alarm about the deadly new virus before dying of it himself triggered rare calls for political reform and freedom of speech.

The "Chinese government's battle against the coronavirus has in no way diverted it from its ongoing general campaign to crush all dissenting voices," said Patrick Poon, China researcher at Amnesty International, in an emailed statement.

Another source, who spoke to news agency on the condition of anonymity, said Xu had been arrested in the southern city of Guangzhou.

Guangzhou police did not respond to requests for comment.

Xu went into hiding after authorities broke up a December gathering of intellectuals discussing political reform in the eastern coastal city of Xiamen in Fujian province, prior to the coronavirus crisis.

Over a dozen lawyers and activists were detained or disappeared after the Xiamen gathering, according to rights groups -- and Xu's detention appears linked to his presence at the meeting, explained Poon.

But while on the run, Xu continued to post information on Twitter about rights issues.

On February 4 Xu released an article calling on Xi to step down and criticised his leadership across a range of issues including the US-China trade war, Hong Kong's pro-democracy protests and the coronavirus epidemic, which has now killed nearly 1,900 people.

"Medical supplies are tight, hospitals are filled with patients, and a large number of infected people have no way to be diagnosed," he wrote. "It's a mess."

"The coronavirus outbreak shows just how important values like freedom of expression and transparency are -- the exact values that Xu has long advocated," Yaqiu Wang, China researcher at Human Rights Watch, told news agency.

But the disappearance of Xu illustrates how the Chinese state "persists in its old ways" by "silencing its critics", she said.

Xu -- who founded a movement calling for greater transparency among high-ranking officials -- previously served a four-year prison sentence from 2013 to 2017 for organising an "illegal gathering".

"That he was a fugitive for so many days while continuing to speak out, that in itself was... a kind of challenge to (Chinese authorities)," said Hua Ze, a long-time friend of Xu who told AFP she lost contact with the Chinese activist on Saturday morning.

Seoul, Apr 26: A train presumed to belong to North Korean's Kim Jong-un has been spotted at a station in the state's eastern coastal town of Wonsan amid speculation about the leader's health, a US monitor said on Sunday, citing commercial satellite imagery on the region, Yonhap news agency reported.

According to 38 North-- a website devoted to analysis about North Korea, the imagery showed a train "probably belonging to Kim Jong Un parked at the Leadership Railway Station servicing his Wonsan compound since at least April 21."

"The approximately 250-metre long train, although partially covered by the station's roof, can be seen at a railway station reserved for use by the Kim family. It was not present on April 15 but was present on both April 21 and 23," it said.

"The train's presence does not prove the whereabouts of the North Korean leader or indicate anything about his health, but it does lend weight to reports that Kim is staying at an elite area on the country's eastern coast," it added.

The report came as rumours about his health have spread as Kim apparently skipped an important annual visit to the Kumsusan Palace of the Sun on the occasion of the April 15 birthday of late state founder and his grandfather, Kim Il-sung.

CNN intensified the speculation by reporting earlier last week that the United States is looking into intelligence that Kim is "in grave danger" after surgery.

Seoul officials have disputed recent media reports about Kim, saying there have been no unusual signs from the North. Some said that Kim is presumed to be staying in Wonsan for unspecified reasons.

Washington has also dismissed the reports, with US President Donald Trump calling such reports "incorrect" in a press briefing late last week.

On Saturday, other media reports stated that China has dispatched a team of medical doctors and officials to North Korea "to advise on" Kim, citing multiple unnamed people familiar with the situation.

North Korea's state media, however, has not made any mention of Kim's public activity for two weeks since he was last seen in April 11 presiding over a major party meeting, though it has reported on his handling of routine state affairs, such as sending diplomatic letters.
But not all speculation has proven to be false.

When he was absent from public for about a month in 2014, speculation arose about his health and a political crisis in the secretive state. He later reemerged with a cane and a limp reportedly after having a cyst removed from his ankle.

The 36-year-old leader is known to have various health problems apparently caused by obesity and heavy smoking. He took office as leader of the communist state after his father, Kim Jong-il, died of a heart attack in late 2011.