For the last week and a half, journalists from various media outlets in Kyrgyzstan have been complaining about attempts to break into their social media, messenger, and email accounts. Kloop is not an exception. Hackers were unable to gain access to the accounts of a majority of journalists.
Kloop became aware of the attempts to break into the accounts of more than 20 journalists from different publications in the last week and a half. The hackers were most concerned with gaining access to Telegram accounts. These cases are connected by the fact that the majority of the attacks were committed from one specific phone model using the same provider.
These attempts to break into journalists’ accounts are occurring against the backdrop of growing pressure placed on journalists and activists in Kyrgyzstan.
2021 was characterized by pressure on mass media—protests against Azattyk, attacks from bots on independent journalists, the president’s open criticism of certain editorial offices, and interrogations of journalists.
Nevertheless, the year ended with a public declaration from representatives of the Kyrgyz government about the importance of freedom of speech in Kyrgyzstan. It was even talked about in the international arena, for example, during a UN session in Geneva.
While congratulating journalists on Press Day, President Sadyr Japarov declared that neither he nor his Cabinet of Ministers would pressure or file lawsuits against journalists, unlike his predecessors.
However, despite the president’s reassurances, pressure on journalists only increased.
The first warning sign was the search of the office of the research publication Temirov Live, which took place in the evening of January 22. According to the editor-in-chief of the publication Bolot Temirov, drugs were planted on him during this search. Now he is being investigated for manufacturing drugs without intention to sale.
Later, it became known that the pursuit of Temirov and his employees had begun a long time before that. They had been under surveillance since at least December 2021, and one of the employees was even blackmailed.
The first instances of hacking into journalists’ accounts began being noticed even earlier—in November.
“Hackers attempted to break into the Telegram accounts of two journalists in November, and in the end of January and beginning of February they wanted to hack into two people’s Facebook accounts and several people’s Telegram accounts,” says Dina Maslova the editor-in-chief of Kaktus Media.
Despite the fact that the attacks persisted and that hackers were not only breaking into the accounts of Kaktus’s employees, these attacks were less concentrated.
Kloop analyzed these attempts to hack into journalists’ accounts and concluded that the first coordinated attack occurred February 8—one day before the protests in front of the offices of Kloop and Kaktus, calling for their closures.
Then, hackers began not only to target the accounts of several of Kloop’s and Kaktus’s journalists, but also Yulia Kuleshova, a correspondent from the TV channel April. Anonymous hackers attempted to gain access to her Telegram and Facebook.
Later, her email address was used for an attempted registration for a Yandex ID — this is a single account for Yandex, mobile apps, and sites that support it. It’s unclear why they attempted to do this.
“I don’t use Yandex, and I definitely didn’t sign up for anything there,” says Kuleshova.
The attacks reached their peak on February 18—at least eight journalists from Kloop, Kaktus, and Temirov Live noticed that someone had tried to log into their messenger apps from a different device.
The hackers were able to gain access to the Facebook of an employee of Temirov Live, and they logged into the account several times in the course of a day. It is unclear how exactly they used their access to the account.
The majority of these attacks are connected by the fact that hackers used the same model of phone to gain access to the accounts with the services of a singular internet provider. The attacks were focused on the Telegram app.
All these attempts to hack into accounts have caused particular concern, especially considering the recent detaining of activists and journalists for their social media posts. One of them was Mirlan Uraimov a blogger and member of Butun Kyrgyzstan (United Kyrgyzstan.)
He is accused of calling for a seizure of power in his comments on a Facebook post. He attests that he did not post anything like that and that his account had been hacked.
The next week the State Committee for National Security summoned journalist Semetei Talas uulu for questioning in the case of “the distribution of extremist materials.” Later, he reported that the reason for his questioning was now a Facebook post on the topic of religion.
Who exactly has been trying to gain access to journalists’ accounts is still unknown. Journalists are attempting to deal with the problem on their own: some are changing their passwords, and others are filing police reports.
Kuleshova chose the latter, but law enforcement agencies did not inspire her with confidence.
“We, unfortunately, have not gotten to the point where we can identify these hackers. We do not have the appropriate equipment,” Kuleshova quotes a detective.
A week has passed since she filed the police report, and there has not been any news from the police.
Unfortunately, as Kloop’s analysis shows, attacks and pressure on journalists almost always go unpunished in Kyrgyzstan.
Translated by Taylor Wilson from Respond Crisis Translation
