Threat reportThreat IntelligenceTL-2026-1726
UK Supreme Court Rejects Bahrain's State Immunity Claim in FinSpy/FinFisher Spyware Surveillance Case (Shehabi v Kingdom of Bahrain)
UK Supreme Court Rejects Bahrain's State Immunity Claim in (TL-2026-1726), also tracked as FinSpy Bahrain Campaign, is a medium-severity tracked intrusion set, first published 2026-07-27. It is attributed to Government of the Kingdom of Bahrain (Bahrain) with high confidence, affects Gamma International / FinFisher GmbH FinSpy (FinFisher) Remote, maps to 35 MITRE ATT&CK techniques (T1005, T1012, T1027), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 35MITRE ATT&CK
- Actors
- 1Government of the Kingdom of Bahrain
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-1726
- Threat ID
- TL-2026-1726
- Also known as
- FinSpy Bahrain Campaign, Bahrain FinFisher Surveillance, Shehabi v Kingdom of Bahrain
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Government of the Kingdom of Bahrain
- Attribution confidence
- HIGH
- Nation-state nexus
- Bahrain
- Motivation
- ESPIONAGE
- Target sectors
- civil society, humanrights, legal, journalism, oppositionpolitics, government administration
- Target regions
- united kingdom, bahrain, Middle East, Europe
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in UK Supreme Court Rejects Bahrain's State Immunity Claim in
Malware and tooling: FinFisher RAT, FinFisher Remote Monitoring & Deployment Solutions
How UK Supreme Court Rejects Bahrain's State Immunity Claim in works
The UK Supreme Court ruled 3-2 that the Kingdom of Bahrain cannot claim state immunity over allegations it covertly installed FinSpy (FinFisher) spyware on the UK-based laptops of dissidents Saeed Shehabi and Moosa Mohammed around 2011, enabling data exfiltration, communications interception, and covert microphone/camera surveillance. The ruling caps a decade-long documented FinSpy campaign against Bahraini lawyers, journalists, and opposition figures first exposed by Citizen Lab (2012) and the 2014 Gamma International leak, and establishes that remote spyware installation on a device physically located in the UK falls within the personal-injury exception to the State Immunity Act 1978.
On 27 July 2026 the UK Supreme Court dismissed an appeal by the Kingdom of Bahrain seeking to block a civil suit brought by UK-resident dissidents Saeed Shehabi and Moosa Mohammed, who allege Bahraini agents infected their laptops with FinSpy (FinFisher) spyware around 2011. The 3-2 majority held that because the hacking occurred on devices located in the United Kingdom, the harassment/personal-injury claims fall within section 5 of the State Immunity Act 1978 and Bahrain cannot shield itself with sovereign immunity. The case (previously rejected by the High Court in 2023 and the Court of Appeal on 4 October 2024) is a landmark precedent for holding states accountable for transnational cyber-espionage conducted against dissidents on foreign soil, with direct implications for the commercial surveillance-vendor industry.
FinSpy is the flagship intrusion tool of the FinFisher/FinFisher GmbH suite, marketed by the Gamma Group (Gamma International Ltd, UK; Gamma International GmbH, Munich) as a 'lawful intercept' governmental IT-intrusion product. Bahrain's use of the tool was first technically exposed by Citizen Lab's July 2012 report 'From Bahrain With Love: FinFisher's Spy Kit Exposed', which analyzed FinSpy samples delivered to Bahraini activists via spearphishing emails impersonating Al Jazeera correspondent Melissa Chan, using RAR archives and right-to-left-override (RLO) Unicode tricks to disguise executables as images/documents. Infected machines exfiltrated screenshots, keystrokes, Skype calls, and microphone/webcam captures to a command-and-control server (77.69.140.194) sitting in Bahraini Batelco ADSL IP space, alongside Gamma-operated infrastructure (tiger.gamma-international.de, ff-demo.blogdns.org).
A 6 August 2014 breach of Gamma International's internal network by the hacker 'Phineas Fisher' (40GB of leaked source code, sales records, and customer-support tickets, later mirrored on WikiLeaks) confirmed that Bahraini authorities infected at least 77 computers between 2010 and 2012, including those of opposition leader Hassan Mushaima (infected 14 November 2010), human-rights lawyer Mohamed Altajer (infected 24 January 2011, the same day he was sent a blackmail video), and UK-resident activists Shehabi and Mohammed. Privacy International filed a criminal complaint with the UK National Crime Agency on 13 October 2014 over Gamma International UK's role in supplying the malware. FinFisher GmbH entered insolvency proceedings in December 2021/2022 amid German export-control investigations, and four former FinFisher executives were charged in Munich in 2023 over an unlicensed sale of the system to Turkey.
MITRE ATT&CK techniques used in TL-2026-1726
Collection
T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture; T1429 Audio Capture; T1430 Location Tracking; T1636 Protected User Data
Discovery
T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1134 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel
Execution
privilege-escalation
T1404 Exploitation for Privilege Escalation
Persistence
T1542 Pre-OS Boot; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts
Reconnaissance
T1589 Gather Victim Identity Information
defense-impairment
Affected products and versions in UK Supreme Court Rejects Bahrain's State Immunity Claim in
- Gamma International / FinFisher GmbH — FinSpy (FinFisher) Remote Monitoring & Deployment Solutions
Vulnerable versions: FinSpy v2; FinSpy v4.01 - Victim endpoints — Microsoft Windows workstations belonging to UK- and Bahrain-based dissidents, lawyers, and journalists
Vulnerable versions: Windows desktop builds in use circa 2010-2012
Remediation for UK Supreme Court Rejects Bahrain's State Immunity Claim in
Immediate actions
- Block and alert on egress to known historical FinSpy C2 indicators (77.69.140.194, 77.69.149.194, tiger.gamma-international.de, ff-demo.blogdns.org) at perimeter firewalls and DNS resolvers
- Filter/quarantine inbound RAR and other archive attachments whose contained filenames use Unicode right-to-left-override (RLO, U+202E) characters to disguise executable extensions
- Hunt for anomalous process hollowing into winlogon.exe and svchost.exe and for unsigned child processes spawned from those images
Workarounds
- Enforce mail-gateway sandboxing/detonation of archive attachments before delivery to at-risk user groups
- Apply application allow-listing to block unsigned binaries matching known FinSpy dropper naming conventions
Longer-term hardening
- Deploy EDR with behavioral detection for DLL injection, KernelCallbackTable hijacking, credential API hooking, and unexpected screen/audio/webcam capture API usage by non-standard processes
- Provide targeted digital-security support (e.g., Citizen Lab, Access Now Digital Security Helpline) to at-risk civil-society members, journalists, lawyers, and dissidents who may be targeted by commercial mercenary-spyware operators
- Track and support export-control enforcement and litigation against commercial surveillance vendors (FinFisher/Gamma-style suites) selling to governments with records of targeting civil society
Weaknesses (CWE) in UK Supreme Court Rejects Bahrain's State Immunity Claim in
Timeline of UK Supreme Court Rejects Bahrain's State Immunity Claim in
- Opposition leader Hassan Mushaima's computer is infected with FinSpy, per Gamma International support-ticket logs later leaked in the 2014 breach.
- Bahraini agents allegedly install FinSpy on the UK-based laptops of dissidents Saeed Shehabi and Moosa Mohammed, enabling data exfiltration, communications interception, and covert microphone/camera surveillance (exact date approximate per court filings).
- Human-rights lawyer Mohamed Altajer's computer is infected with FinSpy the same day a blackmail CD containing an intimate video of him is delivered to his office, implicating Bahraini authorities directly in the tasking.
- Leaked Gamma customer-support correspondence references '30 target licenses' actively in use by the Bahraini FinSpy operator.
- Bahraini FinSpy operators report a 'big lose of data' to Gamma technical support, per leaked support tickets.
- Bahraini activists are targeted with FinSpy-laden RAR archive email lures impersonating Al Jazeera English correspondent Melissa Chan, using right-to-left-override Unicode tricks to disguise executables as images/documents.
- Citizen Lab publishes 'From Bahrain With Love: FinFisher's Spy Kit Exposed', the first public technical analysis confirming FinSpy use against Bahraini dissidents, with C2 traffic traced to Bahraini Batelco IP space.
- Hacker 'Phineas Fisher' breaches Gamma International's internal network and leaks 40GB of source code, sales records, and customer-support data.
- Bahrain Watch and The Intercept publish analysis of the leaked data confirming at least 77 computers were infected with FinSpy between 2010 and 2012, including lawyers, journalists, and opposition figures; Shehabi and Mohammed learn their own machines were among those targeted.
- WikiLeaks republishes and indexes the leaked Gamma/FinFisher internal data set, broadening public access to the evidence.
- Privacy International files a criminal complaint with the UK National Crime Agency's National Cyber Crime Unit over Gamma International UK's role in supplying FinFisher used to unlawfully surveil the Bahraini activists.
- Saeed Shehabi and Moosa Mohammed file a civil suit against the Kingdom of Bahrain at the London High Court seeking damages for psychiatric harm caused by the spyware surveillance.
- The London High Court rejects Bahrain's claim of state immunity, allowing the case to proceed.
- The Court of Appeal upholds the High Court's rejection of Bahrain's state immunity claim, prompting Bahrain to appeal to the UK Supreme Court.
- The UK Supreme Court dismisses Bahrain's appeal 3-2, holding that spyware installation on devices located in the UK falls within the personal-injury exception to the State Immunity Act 1978, letting the activists' claims proceed.
Sources cited for UK Supreme Court Rejects Bahrain's State Immunity Claim in
- UK court rejects Bahrain immunity claim in spyware case
- The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents)
- UK Supreme Court says no state immunity for Bahrain in surveillance case
- Bahrain cannot claim sovereign immunity for spyware attack against UK dissidents, top UK court rules
- Shehabi v Kingdom of Bahrain (Court of Appeal judgment)
- From Bahrain With Love: FinFisher's Spy Kit Exposed
- The SmartPhone Who Loved Me: FinFisher Goes Mobile?
- Elusive FinFisher Spyware Identified and Analyzed
- Leaked Files: German Spy Company Helped Bahrain Hack Arab Spring Protesters
- Bahrain Government Hacked Lawyers and Activists with UK Spyware
- Bahraini Government, With Help From FinFisher, Tracks Activists Living In The United Kingdom
- Privacy Group Targets British Spyware Company over Bahrain Surveillance
- FinFisher spyware used to snoop on Bahraini activists, police told
- FinFisher (Software) - MITRE ATT&CK S0182
- FinFisher
Detection coverage for TL-2026-1726
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1726 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.