# Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human Rights Defenders (NSO Group)

> NSO Group's Pegasus zero-click mobile spyware was deployed by an Azerbaijani government operator to conduct covert state surveillance of journalists, activists, and human rights defenders. An amicus brief filed at the European Court of Human Rights on 21 April 2026 documents how Pegasus turns a target's phone into a 24-hour surveillance device with full remote access to its contents and real-time audio/video capture; Amnesty International's Security Lab forensically confirmed infections of Azerbaijani journalists including Khadija Ismayilova and Sevinj Vagifgizi between 2019 and 2021.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0751
- **ID:** TL-2026-0751
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** NSO Group operated by Government of Azerbaijan customer (Azerbaijan)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-30860, CVE-2023-41064, CVE-2023-41061, CVE-2016-4655, CVE-2016-4656, CVE-2016-4657

## Description

Pegasus is a commercial (mercenary) mobile-surveillance implant developed and sold by Israeli vendor NSO Group exclusively to state customers. On 21 April 2026 the Committee to Protect Journalists (CPJ), Access Now, Data Rights, and Human Constanta filed a third-party intervention (amicus curiae brief) at the European Court of Human Rights (ECtHR) in support of a group of cases brought by Azerbaijani journalists, activists, and human rights defenders. The brief argues that the covert deployment of Pegasus against journalists violates the European Convention on Human Rights — in particular the right to private life and the protection of journalistic sources — and that European legislative safeguards and independent oversight are inadequate.

The underlying surveillance was first exposed through the 2021 Pegasus Project, a collaborative investigation coordinated by Forbidden Stories with the technical support of Amnesty International's Security Lab, based on a leak of more than 50,000 phone numbers selected for targeting by NSO Group clients. More than 1,000 Azerbaijani numbers appeared on the list selected by a single Azerbaijani government customer; the consortium named 74 of these targets and forensically confirmed Pegasus infection on the devices of at least five members of Azerbaijani civil society between 2019 and 2021. Confirmed victims include Khadija Ismayilova, a leading investigative journalist formerly with Radio Free Europe/Radio Liberty, whose iPhone was repeatedly re-infected with Pegasus over nearly three years, and Sevinj Vagifgizi, a reporter for the Berlin-based independent outlet Meydan TV.

Technically, Pegasus is delivered primarily through zero-click exploit chains that require no victim interaction. Documented chains include FORCEDENTRY (CVE-2021-30860), an integer-overflow flaw in Apple's CoreGraphics/JBIG2 image-rendering code delivered over iMessage that defeats the iOS BlastDoor sandbox, and BLASTPASS (CVE-2023-41064 with CVE-2023-41061), which abused a maliciously crafted image passed through the iOS PassKit / iMessage pipeline to compromise fully patched iPhones running iOS 16.6 without interaction. NSO's earlier 'Trident' one-click chain (CVE-2016-4655, CVE-2016-4656, CVE-2016-4657) was the first captured Pegasus exploit, found on the phone of UAE activist Ahmed Mansoor in 2016. Once installed, Pegasus grants the operator full remote control of the device: exfiltration of messages (including end-to-end encrypted apps), photos, contacts, call logs, browsing history, and credentials; precise GPS location tracking; and the ability to silently activate the microphone and camera for real-time audio and video capture. Amnesty International's forensic methodology identifies Pegasus through disguised process names (notably 'bh'/'BridgeHead' and 'setframed'), iMessage account-lookup artifacts, and a large rotating set of Version 4 installation and command-and-control domains (Amnesty fingerprinted roughly 700 Pegasus domains). The Mobile Verification Toolkit (MVT), released by Amnesty alongside STIX2 indicators, lets defenders scan iOS and Android devices for these traces.

The Government of Azerbaijan has dismissed the Pegasus findings as a 'baseless fabrication.' This record is published for defensive and protective use by SOC analysts, incident responders, human-rights technologists, and at-risk civil-society defenders.

## MITRE ATT&CK

- T1456 Drive-By Compromise
- T1660 Phishing
- T1658 Exploitation for Client Execution
- T1575 Native API
- T1398 Boot or Logon Initialization Scripts
- T1404 Exploitation for Privilege Escalation
- T1407 Download New Code at Runtime
- T1630 Indicator Removal on Host
- T1628 Hide Artifacts
- T1406 Obfuscated Files or Information
- T1517 Access Notifications
- T1409 Stored Application Data
- T1426 System Information Discovery
- T1418 Software Discovery
- T1429 Audio Capture
- T1512 Video Capture
- T1430 Location Tracking
- T1636 Protected User Data
- T1417 Input Capture
- T1513 Screen Capture
- T1532 Archive Collected Data
- T1437 Application Layer Protocol
- T1481 Web Service
- T1646 Exfiltration Over C2 Channel

## Sources

- [Amicus brief on spyware and surveillance in Azerbaijan](https://www.accessnow.org/publication/amicus-brief-on-spyware-and-surveillance-in-azerbaijan/)
- [CPJ, partners file ECtHR amicus brief on spyware use against journalists in Azerbaijan](https://cpj.org/2026/04/cpj-partners-file-ecthr-amicus-brief-on-spyware-use-against-journalists-in-azerbaijan/)
- [Forensic Methodology Report: How to catch NSO Group's Pegasus](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/)
- [Amnesty Tech NSO investigation indicators (MVT / STIX2)](https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso)
- [FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild](https://citizenlab.ca/research/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/)
- [BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild](https://citizenlab.ca/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/)
- [Sevinj Vaqifqizi, Azerbaijani Reporter (Pegasus Project)](https://www.occrp.org/en/project/the-pegasus-project/sevinj-vaqifqizi-azerbaijani-reporter)
- [Life in Azerbaijan's Digital Autocracy: They Want to be in Control of Everything](https://www.occrp.org/en/project/the-pegasus-project/life-in-azerbaijans-digital-autocracy-they-want-to-be-in-control-of-everything)
- [Azerbaijani journalist Sevinj Vagifgizi was 'astonished' to learn of Pegasus spyware on phone](https://cpj.org/2021/07/azerbaijani-journalist-sevinj-vagifgizi-was-astonished-to-learn-of-pegasus-spyware-on-phone/)
- [Journalist Targeted With Pegasus Spyware Speaks Out (Khadija Ismayilova) - PBS FRONTLINE](https://www.pbs.org/wgbh/frontline/article/pegasus-spyware-scandal-khadija-ismayilova-documentary-excerpt/)
- [The Pegasus Project - Amnesty International Security Lab](https://securitylab.amnesty.org/case-study-the-pegasus-project/)
- [Apple addresses zero-day, zero-click NSO Group BLASTPASS exploit](https://www.techtarget.com/searchsecurity/news/252506695/Apple-patches-zero-day-zero-click-NSO-Group-exploit)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0751