Jordan Government’s Use of Cellebrite Forensics Tools Targets Activists in 2024
Executive Summary
Between late 2023 and mid-2024, Jordanian authorities used Cellebrite’s digital forensic technology to access and extract data from the mobile phones of local activists and human rights defenders. According to an investigation by Citizen Lab and OCCRP, authorities seized activists’ devices—three iPhones and one Android—and subjected them to Cellebrite’s phone-cracking tools, often in connection with political protests. Court records and forensic analysis confirmed the use of Cellebrite products to nonconsensually access information, shaking victims’ trust and prompting self-censorship.
This incident underscores the growing risks of commercial digital forensics tools being repurposed for surveillance beyond criminal cases. Amnesty International and other watchdogs report a broader trend of such technologies being leveraged against civil society, signaling a need for stronger governance, vendor accountability, and compliance oversight globally.
Why This Matters Now
This incident highlights urgent concerns about the abuse of law enforcement and forensics technologies in suppressing dissent, especially as global protests and digital activism intensify. As more governments deploy commercial phone-cracking tools, risks to privacy, civil liberties, and compliance with international norms are rising, requiring immediate scrutiny and action.
Attack Path Analysis
The attack began when Jordanian authorities physically seized activists’ devices, gaining initial physical access. After device seizure, Cellebrite phone-cracking technology was used to bypass security controls or exploit device vulnerabilities, escalating privileges to access otherwise protected information. Once device data was accessible, authorities moved laterally within the device storage to gather comprehensive data sets across applications and user files. There was no evidence of traditional remote command and control, as operations were performed locally post-seizure. Sensitive data from phones was then exfiltrated using Cellebrite's forensic extraction tools, transferring private information to government-controlled repositories. The impact stage consisted of activists' personal and confidential data being used for investigation, prosecution, or broader intimidation, eroding trust and personal security within civil society.
Kill Chain Progression
Initial Compromise
Description
Physical seizure of mobile devices by authorities, granting full hands-on access for subsequent exploitation.
Related CVEs
CVE-2024-53104
CVSS 7.8An out-of-bounds write vulnerability in the USB Video Class (UVC) driver allows local attackers to execute arbitrary code or cause a denial of service.
Affected Products:
Linux Kernel – < 5.10.0
Exploit Status:
exploited in the wildCVE-2024-53197
CVSS 7.1A flaw in the ALSA USB audio driver allows local attackers to cause memory corruption, potentially leading to privilege escalation.
Affected Products:
Linux Kernel – < 5.10.0
Exploit Status:
exploited in the wildCVE-2024-50302
CVSS 5.5A vulnerability in the USB HID device driver allows local attackers to leak kernel memory, potentially leading to information disclosure.
Affected Products:
Linux Kernel – < 5.10.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
ATT&CK techniques mapped for digital forensics abuse via Cellebrite technology based on current incident context. For advanced analysis, further STIX/TAXII enrichment may be applied.
Password Cracking
Data from Local System
Input Capture: Keylogging
Unsecured Credentials: Credentials in Files
Steal Web Session Cookie
Data from Removable Media
OS Credential Dumping: Security Account Manager
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIS2 Directive – Access Control and Asset Management
Control ID: Article 21(2)(d)
PCI DSS 4.0 – Limit Access to System Components and Cardholder Data
Control ID: 8.2.1
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Continuous Identity, Device, and Access Validation
Control ID: Identity Pillar / Device Pillar
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: Section 500.7
DORA (EU Digital Operational Resilience Act) – ICT Risk Management – User Access Management
Control ID: Article 9(2)
ISO/IEC 27001:2022 – Access to Networks and Network Services
Control ID: A.9.1.2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Direct exposure to digital forensics abuse as Jordanian authorities used Cellebrite technology against activists, violating human rights compliance standards.
Law Enforcement
Cellebrite phone-cracking technology misuse demonstrates risks of forensic tool abuse, requiring enhanced oversight and zero trust segmentation protocols.
Non-Profit/Volunteering
Human rights defenders and activists targeted through device seizure and forensic extraction, highlighting need for encrypted communications and egress security.
Civic/Social Organization
Political activists subjected to unauthorized device forensics during Palestinian protests, demonstrating vulnerability to state surveillance and data exfiltration threats.
Sources
- Researchers find Jordan government used Cellebrite phone-cracking tech against activistshttps://cyberscoop.com/researchers-find-jordan-government-used-cellebrite-phone-cracking-tech-against-activists/Verified
- Cellebrite zero-day exploit used to target phone of Serbian student activisthttps://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/Verified
- Google addresses 2 actively exploited vulnerabilities in security updatehttps://cyberscoop.com/android-security-update-april-2025/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, strong egress controls, and traffic encryption would have raised the cost of data extraction by limiting internal access scope, enforcing policy on exfiltration, and ensuring data confidentiality even if device or workload storage was compromised. CNSF-aligned controls provide technical measures that reduce broad access and movement during forensic extraction and help detect anomalous inbound or outbound large data transfers.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Minimizes risk by ensuring device and cloud access require dynamic policy checks beyond physical possession.
Control: Zero Trust Segmentation
Mitigation: Restricts scope of breach by segmenting access based on identity and context, limiting privilege inheritance post-compromise.
Control: East-West Traffic Security
Mitigation: Prevents broad data harvesting across cloud workloads by limiting authorized internal flows.
Control: Multicloud Visibility & Control
Mitigation: Detects and flags unexpected device or account behaviors within cloud services.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks unauthorized outbound data transfers and enforces exfiltration controls.
Reduces utility of exfiltrated data by keeping content encrypted and unreadable outside trusted environments.
Impact at a Glance
Affected Business Functions
- Legal Compliance
- Public Relations
- Human Rights Advocacy
Estimated downtime: N/A
Estimated loss: N/A
Unauthorized access to activists' personal data, including photos, videos, chats, files, saved passwords, location history, Wi-Fi history, phone usage records, web history, and social media accounts.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce device- and workload-level encryption to ensure data remains protected even if storage is compromised or physically seized.
- • Implement zero trust segmentation and least privilege access to minimize information exposure across cloud and endpoint environments.
- • Apply granular egress controls to block unauthorized data transfers from both cloud workloads and end-user devices.
- • Centralize visibility and analytics across multi-cloud and hybrid infrastructure to detect signs of large-scale extraction or anomalous access.
- • Regularly review and test incident response, focusing on readiness for physical device compromise and forensic extraction scenarios.
