← threat actors
threat actor · not yet in the cluster map
nso-group
5 stories · 5 in the wild · June 22, 2026 – October 14, 2026
evidence: 4 observed · 1 attempted
geography
- poland 1 · Oct 14
- serbia 1 · Sep 4
- germany 1 · Aug 1
- eu 1 · Jul 4
malware and tools
- pegasus 4 · Sep 4
- novispy 1 · Sep 4
techniques
- zero click 1 · Sep 4
- exploitation 1 · Aug 1
attack phases seen
- Initial access 3 · Sep 4
- Execution 1 · Aug 1
- Persistence 1 · Aug 1
what we reported, newest first, grouped by story
October 14, 2026
- Polish prosecutors say Pegasus-collected data left Polish territory and NSO Group may have had access to the processing and storage infrastructure. The ABW analysis found the Central Anti-Corruption Bureau lacked full control over the system; PM Donald Tusk called it a crime against the state (UA.News / Anadolu).
· Oct 14 · observed · Nordics & Europe
September 4, 2026
- Pegasus zero-click infections hit Serbia's student protest movement. Citizen Lab and the SHARE Foundation confirmed an iMessage zero-click delivering NSO Group's Pegasus onto a protester's iPhone (The Hacker News); at least 14 Serbians — including an MP and opposition figures — have been targeted with Pegasus or the local NoviSpy implant since December (The Record).
· Sep 4 · observed · Threat Activity
Jul 4 – August 1, 2026 · 2 reports
- A member of the European Parliament's spyware-investigation committee was hacked with Pegasus. Citizen Lab's forensic analysis found German MEP Daniel Freund's iPhone compromised with NSO Group's spyware — while he served on the PEGA follow-up committee examining spyware abuse (Citizen Lab). (discussion)
· Aug 1 · observed · Threat Activity
- Pegasus found on the phone of an EU lawmaker probing spyware. Citizen Lab reports former MEP Stelios Kouloglou was infected twice with Pegasus while serving on the European Parliament committee investigating commercial spyware abuse. Citizen Lab · The Record
· Jul 4 · observed · Threat Intelligence
June 22, 2026
- WhatsApp intends to seek contempt charges against NSO Group, alleging fresh Pegasus targeting that bypassed court orders. Citizen Lab.
· Jun 22 · attempted · Threat Activity & CTI