Australia's nuclear science agency and other highly sensitive government and critical infrastructure organisations have been targeted by a sophisticated, foreign bad actor that secretly weaponised online advertising to track millions of devices and install spyware on some systems, according to researchers.
Research group, The Citizen Lab, said it found proof that an Israel-based company exploited digital advertising technology to install back doors onto devices, merely by the victim viewing an advertisement on a website or in an app.
It said millions of devices were targeted in the unprecedented attack, including those on networks belonging to Australian Nuclear Science and Technology Organisation (ANSTO) and a number of other Australian government agencies, critical infrastructure and major media organisations.
A spokesperson for ANSTO said it had not identified any impact to its systems as a result of the techniques identified by The Citizen Lab.
Deakin University associate professor Diarmaid Harkin, who has researched the spyware industry, said it was a novel case revealing how bad actors were using online infrastructure to compromise their opponents.
"This is a demonstration of how the online advertising industry is not only being used to surveil, but also is being exploited for what looks like espionage,"
he said.
A 'little bit' of code in an online ad enough to install backdoor
The Citizen Lab is a University of Toronto research lab that has uncovered numerous high-profile examples of cyber espionage targeting governments, businesses, non-for-profits, media outlets and political organisations.
Last week, it published a report, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, that identified what it said were bad actors using online advertising to infect devices using spyware.
Dr Harkin said normal online advertising technology runs a "little bit" of code in browsers and apps to show an ad.
"That's normally something innocent, but this time, it wasn't the case," he said.
A screenshot highlighting the Discover-Tech ads. (X: John Scott-Railton)
Instead, this exploit — called ''zero-click mercenary spyware" — allowed bad actors to run code on devices that installed software that acted as a backdoor to the device, allowing them to access things like passwords, emails and details of internal systems.
The Citizen Lab claims that a company, Discover-Tech, acted as the go-between for online advertising platforms like Google and spyware and hacking companies. At least one of those, Candiru, has been placed under US export controls because of its "malicious cyber activities".
As part of normal online advertising practices, Discover-Tech "bid" against other prospective advertisers to show ads on websites and apps like Duolingo, the BBC and New York Times.
When they won the online auctions, they showed seemingly benign ads to users that secretly included code that could infect their devices.
"This report shows that this ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report said.
The Citizen Lab verified that bad actors were able to use these advertisements to infect devices belonging to international news network Al Jazeera.
The research group traced the moment from Al Jazeera devices first seeing the infected ad, to the initial contact between its devices and servers spyware maker Candiru, to files being installed on the Al Jazeera computers that would hijack the device.
Merely viewing the ad didn't guarantee the devices were successfully infected, only that it had been exposed to the exploit.
However, researchers said the company was also able to exploit the online advertising technology to profile devices so it could identify them, track their web activity and find their geographical location.
This information would be enough to reveal a person's name or suggest where they worked, and was used to help target the subsequent spyware attacks, researchers claim.
Public records from online advertising show that Discover-Tech carried this out against millions of devices.
Australian critical infrastructure and nuclear-linked organisations targeted
Among numerous international defence forces, cyber agencies, and international organisations including NATO, The Citizen Lab highlighted a "substantial cluster" of impressions in Australian critical infrastructure, government, university and media networks.
The report does not specify most of these, however it does say many Australian targets were working on nuclear research, and named the ANSTO and its Australian Synchrotron research campus.
A spokesperson for ANTSO said it was aware of the reports but said its systems had not been breached.
"We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports," they said.
The Department for Home Affairs directed the ABC's inquiries to Australia's cyber intelligence agency, the Australian Signals Directorate, which declined to comment.
The Citizen Lab report said Google removed Discover-Tech from its platform once the researchers had shared their findings.
Dr Harkin said the report showed how the size and ubiquity of online advertising offered a unique opportunity for bad actors
"What this demonstrates is how zero-click exploits need to find information about who to target with that particular exploit and vulnerability. And what allows them is using the ad tech," he said.
Dr Harkin said it raised questions about how a company was able to gain the trust of major advertising players, like Google, and use them to distribute their exploit without being caught.
"If these ads are being delivered to our devices, our browsers, are they going to do anything malicious once they reach the user? That's the question that needs to be handled upstream by those who are running these ecosystem and by who's regulating them," he said.
"Who's acting as a watchdog for these digital advertising systems?"
Google was approached for comment.