FlagThis - #pegasus

Amnesty International's Security Lab has uncovered evidence that two investigative journalists from the Serbia-based Balkan Investigative Reporting Network (BIRN) were targeted with NSO Group’s Pegasus spyware in February 2025. This marks the third time in two years that Amnesty International has found Pegasus being used against civil society members in Serbia, building upon previous findings detailed in their December 2024 report, "A Digital Prison." The journalists received suspicious text messages, and research confirmed the links led to a domain previously identified as part of NSO Group's infrastructure.

These latest findings reinforce concerns about Serbian authorities abusing invasive spyware to target journalists, activists, and other members of civil society. NSO Group responded to Amnesty International's findings by stating they cannot comment on specific customers or disclose technical information, while reiterating their commitment to respecting human rights and upholding the UN Guiding Principles on Business and Human Rights. Despite this commitment, security researchers are increasingly able to detect Pegasus attacks, suggesting challenges for NSO Group in maintaining operational security and concealing their activities.


References :

• securitylab.amnesty.org: Journalists targeted with Pegasus spyware - Amnesty International Security Lab
• CyberInsider: Viber Messenger Abused for Delivering Pegasus Spyware on Targets
• thecyberexpress.com: Investigative Journalists in Serbia Hit by Advanced Spyware Attack
• techcrunch.com: Again and again, NSO Group’s customers keep getting their spyware operations caught
• infosec.exchange: NEW: Despite its lofty promises of invisibility, NSO Group customers keep getting their spyware operations against journalists and dissidents caught. “NSO has a basic problem: they are not as good at hiding as their customers think,” said John Scott-Railton, who has investigated spyware for 10+ years. This week, it was the turn of the Serbian government, who allegedly targeted two journalists with NSO Group's spyware Pegasus, according to Amnesty International.
• PrivacyDigest: Again and again, Group’s customers keep getting their operations caught | TechCrunch On Thursday, published a new report detailing attempted against two , allegedly carried out with NSO Group’s spyware .
• ESET Research: NEW: Despite its lofty promises of invisibility, NSO Group customers keep getting their spyware operations against journalists and dissidents caught. “NSO has a basic problem: they are not as good at hiding as their customers think,â€� said John Scott-Railton, who has investigated spyware for 10+ years. This week, it was the turn of the Serbian government, who allegedly targeted two journalists with NSO Group's spyware Pegasus, according to Amnesty International.
• The420.in: The murky world of cyber surveillance has once again been thrust into the spotlight as Amnesty International uncovered an attempt to hack two Serbian journalists using Pegasus, the notorious spyware developed by Israeli firm NSO Group.

Classification:

• HashTags: #Pegasus #Spyware #Serbia
• Company: NSO Group
• Target: Two investigative journalists in Serbia
• Attacker: Amnesty International
• Product: Viber
• Feature: Spyware
• Malware: Pegasus
• Type: Espionage
• Severity: Major