Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and Student Protesters

Key facts for Pegasus NoviSpy Serbian campaign

Detection coverage for Pegasus NoviSpy Serbian campaign

As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2316 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Pegasus/Cellebrite Exploitation Chain — Messaging-Process Crash Correlated to Outbound Connection (SPL Primary)

Detects the forensic pattern documented by Citizen Lab and Amnesty's MVT (Mobile Verification Toolkit) for Pegasus zero-click iMessage delivery: a crash of iMessage-related processes (imagent, identityservicesd, assistantd) on an unpatched (pre-18.4.1) device, correlated within 5 minutes to an outbound connection to infrastructure outside the corporate/known-good CIDR ranges. Also correlates DNS lookups to icloud-i-cl.com, a TL_OSINT_Scan medium-confidence lookalike Apple-ID-phishing domain tagged to this campaign's 'pegasus' cluster (OSINT-tier corroboration, not independently confirmed for this threat) — Apple ID credential theft is a documented precursor technique for enabling iCloud-based surveillance/backup access alongside Pegasus.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1664, T1658, T1660, T1456
• Data sources: mobile_threat_defense (mvt / defender_for_endpoint_mobile), mdm (jamf_pro / intune), dns, network_firewall_proxy (pan / zeek)
• Severity: critical
• Confidence: high

Splunk SPL

index=mtd (sourcetype="mvt:ios:crash_reports" OR sourcetype="jamf:mobiledevice" OR sourcetype="defender:mobile")
| eval crash_process=coalesce(process_name, procname)
| where match(crash_process, "(?i)(imagent|identityservicesd|assistantd|commcenter|nsurlsessiond)")
| eval crash_time=_time, ios_version=coalesce(os_version, "unknown")
| join type=left device_id
    [ search index=network (sourcetype="pan:traffic" OR sourcetype="zeek:conn")
      | where NOT cidrmatch("10.0.0.0/8", dest_ip) AND NOT cidrmatch("172.16.0.0/12", dest_ip) AND NOT cidrmatch("192.168.0.0/16", dest_ip)
      | rename _time as conn_time
      | fields device_id, conn_time, dest_ip, dest_port, bytes_out ]
| where isnotnull(dest_ip) AND (conn_time - crash_time) >= 0 AND (conn_time - crash_time) <= 300
| append
    [ search index=dns (sourcetype="zeek:dns" OR sourcetype="stream:dns")
      | where match(query, "(?i)icloud-i-cl\.com")
      | eval risk="OSINT-tier (TL_OSINT_Scan, medium confidence) - Apple ID phishing lookalike domain tagged to pegasus campaign cluster"
      | fields _time, device_id, query, answer, risk ]
| eval vulnerable=if(ios_version<"18.4.1" OR ios_version="unknown", "yes", "no")
| table _time, device_id, user, crash_process, ios_version, vulnerable, dest_ip, dest_port, query, risk
| sort - _time

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "AppCrash"
| where AdditionalFields has_any ("imagent", "identityservicesd", "assistantd", "CommCenter", "nsurlsessiond")
| project CrashTime=Timestamp, DeviceId, DeviceName, ActionType, AdditionalFields
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteIPType == "Public"
    | project ConnTime=Timestamp, DeviceId, RemoteIP, RemotePort, InitiatingProcessFileName
) on DeviceId
| where ConnTime between (CrashTime .. CrashTime + 5m)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has "icloud-i-cl.com"
    | extend Risk = "OSINT-tier (TL_OSINT_Scan, medium confidence) - Apple ID phishing lookalike domain tagged to pegasus campaign cluster"
    | project CrashTime=Timestamp, DeviceId, DeviceName=tostring(DeviceName), ActionType="DnsLookup", RemoteUrl, Risk
)
| order by CrashTime desc

Sigma

title: Messaging-App Link Interaction From Unverified Sender Preceding Mobile Spyware Indicators
id: 7f3a9c1e-4b2d-4e6a-9f21-3c8d5a7b1e02
status: experimental
description: Detects a mobile messaging application (Viber/SMS/WhatsApp) opening a link from a sender number not present in the device contact list, the delivery pattern documented for Pegasus spyware sent to BIRN journalists in Serbia from a number linked to Telekom Srbija, or a lookup of the icloud-i-cl.com Apple-ID phishing lookalike domain (TL_OSINT_Scan, medium-confidence community tag on this campaign's 'pegasus' cluster).
references:
  - https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/
  - https://securitylab.amnesty.org/latest/2024/12/a-digital-prison-surveillance-and-the-suppression-of-civil-society-in-serbia/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-03
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1660
  - attack.t1456
  - attack.t1664
  - attack.t1658
  - attack.tool.pegasus
  - attack.tool.nso_group
logsource:
  category: application
  product: m365_defender
detection:
  selection_link:
    ActionType: 'MessagingLinkOpened'
    AppName|contains:
      - 'Viber'
      - 'Messages'
      - 'WhatsApp'
    SenderInContacts: false
  selection_domain:
    ActionType: 'DnsLookup'
    QueryName|contains: 'icloud-i-cl.com'
  condition: selection_link or selection_domain
falsepositives:
  - New contacts messaging a user for the first time with a legitimate link
  - Unrelated typosquat domain resolution with no further follow-on activity
level: high

Known false positives:

• Legitimate iMessage/Viber/WhatsApp process crash unrelated to exploitation, coincidentally followed by unrelated network activity within the 5-minute window
• A new, legitimate contact messaging the user for the first time with a real link
• Devices already patched to iOS 18.4.1+ are not vulnerable to CVE-2025-31200/CVE-2025-31201 and should be excluded from the high-severity variant of this alert

Tuning notes: Scope to devices belonging to defined high-risk groups (journalists, opposition politicians, civil-society staff, protest organizers) to cut fleet-wide noise; suppress the priv-esc/vulnerable branch once a device confirms iOS 18.4.1+; refresh the Apple-ID phishing lookalike-domain list periodically from TL_OSINT_Scan/tweetfeed since this is OSINT-tier corroboration (medium confidence, single campaign match, zero corroborated IOCs at authoring time) and typosquat domains rotate quickly.

• 🔒 Cellebrite UFED Lockscreen-Bypass Chain — USB Privilege Escalation Preceding App Install (KQL Primary) · unlock with TL Creds
• 🔒 NoviSpy Collection Capability Abuse — Audio/Video/Location/SMS/Contacts (KQL Primary) · unlock with TL Creds
• 🔒 NoviSpy C2 Beaconing + Post-Compromise Discovery (KQL Primary) · unlock with TL Creds
• 🔒 Pegasus/Cellebrite Exploitation Chain — Messaging-Link + USB Bypass (Sigma Primary) · unlock with TL Creds
• 🔒 NoviSpy Package/Hash + Persistence — Amnesty IOC Match (Sigma Primary) · unlock with TL Creds
• 🔒 NoviSpy C2 Infrastructure Match — Amnesty IOC Set (Sigma Primary) · unlock with TL Creds
• 🔒 NoviSpy Install & Accessibility-Service Persistence — MDM App Inventory Match (SPL Primary) · unlock with TL Creds
• 🔒 NoviSpy C2 Beaconing — Published IP Infrastructure (SPL Primary) · unlock with TL Creds

Indicators of compromise for Pegasus NoviSpy Serbian campaign

As of 2026-09-05, Threadlinqs Intelligence tracks 37 indicators of compromise for TL-2026-2316.

Sample indicators (3 of 37)

• IP address: 195.178.51[.]251
• File hash: 54ee2c4f3e2396b6f92def135d68abd35d63ca7f9c304633a36f705ba4728cb7
• IP address: 79.101.110[.]108

Defanged, TLP:CLEAR. Full set of 37 indicators: unlock with TL Creds.

How Pegasus NoviSpy Serbian campaign works

Citizen Lab and Amnesty International's Security Lab confirmed the infections; Apple issued threat notifications to 12 victims in August 2026. Serbia's BIA denies involvement.

Since December 2025, at least 14 Serbian civil society members, opposition figures, and journalists have been targeted with commercial spyware in a campaign that SHARE Foundation calls the largest documented wave of surveillance in the country to date. A member of Serbia's student protest movement had their iPhone infected with NSO Group's Pegasus via an iMessage zero-click exploit requiring no user interaction; Citizen Lab confirmed the infection with high confidence and tied the exploit to the vulnerability class Apple closed in iOS 18.4.1. Two additional devices were confirmed infected with a new variant of NoviSpy, a bespoke Android spyware system first documented by Amnesty International in December 2024 and previously linked by forensic evidence (C2 configuration data) to a BIA (Bezbednosno-informativna agencija, Serbia's Security Information Agency) employee with a history of procuring Hacking Team Android spyware. Apple sent mercenary-spyware threat notifications to 12 of the 14 known victims in August 2026, prompting several to come forward publicly at a September 2, 2026 SHARE Foundation press conference, including student activist Jelena Kontić; on September 3, Green-Left Front MP Radomir Lazović confirmed he was also targeted.

The campaign continues a documented pattern stretching back to November 2023, when Amnesty, Access Now, SHARE Foundation, and Citizen Lab first jointly confirmed zero-click Pegasus infections of Serbian civil society members. In December 2024, Amnesty's 'A Digital Prison' report revealed that Serbian police and BIA had been using Cellebrite UFED forensic-extraction hardware to unlock confiscated Android phones during detentions and covertly install NoviSpy — documenting cases against journalist Slaviša Milanov and a Krokodil NGO activist. In February 2025, Amnesty disclosed that this install chain relied on a then-undisclosed Cellebrite zero-day (a Linux kernel USB Video Class privilege-escalation bug, CVE-2024-53104, alongside related USB-stack flaws CVE-2024-53197 and CVE-2024-50302) used against a 23-year-old student activist's Samsung Galaxy A32; Cellebrite subsequently cut off the responsible Serbian customer. A parallel Qualcomm DSP driver use-after-free (CVE-2024-43047, adsprpc) was also documented in NoviSpy tradecraft. In March 2025, two BIRN investigative journalists were separately targeted with Pegasus via Viber messages sent from a number linked to state operator Telekom Srbija.

The targeting has consistently coincided with Serbian electoral and protest cycles: the current wave overlaps the March 29, 2026 local elections and the anti-government student protest movement that grew out of the 2024 Novi Sad railway-station canopy collapse, and continues ahead of early parliamentary elections expected in October 2026. Serbia's BIA dismissed the allegations as 'trivial sensationalism' serving 'foreign intelligence services,' and Parliament Speaker Ana Brnabić denied state involvement, calling it implausible that a state actor using million-euro spyware would leave forensic traces. NSO Group, the Pegasus developer, has been on the U.S. Commerce Department's Entity List since November 2021 for supplying spyware used to target journalists, activists, and dissidents; it did not respond to requests for comment.

MITRE ATT&CK techniques by tactic:

Persistence

T1398 Boot or Logon Initialization Scripts; T1541 Foreground Persistence; T1624.001 Broadcast Receivers; T1645 Compromise Client Software Binary

Privilege Escalation

T1404 Exploitation for Privilege Escalation; T1626.001 Abuse Elevation Control Mechanism

Collection

T1409 Stored Application Data; T1429 Audio Capture; T1430 Location Tracking; T1453 Abuse Accessibility Features; T1512 Video Capture; T1513 Screen Capture; T1636.002 Call Log; T1636.003 Contact List; T1636.004 SMS Messages

Credential Access

T1417 Input Capture

Discovery

T1418 Software Discovery; T1420 File and Directory Discovery; T1421 System Network Connections Discovery; T1422 System Network Configuration Discovery; T1426 System Information Discovery

Initial Access

T1456 Drive-By Compromise; T1461 Lockscreen Bypass; T1660 Phishing; T1664 Exploitation for Initial Access

Command and Control

T1481 Web Service

Defense Evasion

T1628 Hide Artifacts; T1629.001 Impair Defenses

command-and-control

T1644 Out of Band Data

Exfiltration

T1646 Exfiltration Over C2 Channel

Execution

T1658 Exploitation for Client Execution

Remediation for Pegasus NoviSpy Serbian campaign

Patches

• Apple iOS 18.4.1 / iPadOS 18.4.1 (CVE-2025-31200, CVE-2025-31201)
• Android Security Bulletin, February 2025 (CVE-2024-53104, CVE-2024-53197, CVE-2024-50302)
• Qualcomm fix for CVE-2024-43047 (adsprpc use-after-free)
• Upstream Linux kernel fixes, December 2024, for the UVC and ALSA USB-sound drivers

Immediate actions

• Apply Apple's iOS 18.4.1+ update to close the CoreAudio/RPAC zero-click chain (CVE-2025-31200, CVE-2025-31201) and keep devices on the latest available patch
• Enable Apple Lockdown Mode on iPhones belonging to journalists, activists, opposition politicians, and protest organizers at elevated risk
• Apply the February 2025 Android security bulletin to remediate the Linux kernel USB (UVC/ALSA/HID) lockscreen-bypass chain (CVE-2024-53104, CVE-2024-53197, CVE-2024-50302) and the Qualcomm adsprpc fix (CVE-2024-43047)
• Never surrender an unlocked or unattended phone during a police stop or interview; power devices off before any encounter with security services
• Scan Android devices with AndroidQF + Mobile Verification Toolkit (MVT) against Amnesty's published NoviSpy IOC set (package names, cert hashes, sample hashes, C2 IPs)

Workarounds

• Enable Lockdown Mode (iOS) or Advanced Protection Program (Android) for high-risk users
• Avoid connecting devices to untrusted USB accessories or forensic docking stations; disable USB debugging
• Treat any device confiscated by authorities, even briefly, as compromised and replace or fully re-provision it afterward

Longer-term hardening

• Enroll high-risk individuals by default in Google's Advanced Protection Program and Apple's Lockdown Mode
• Civil society organizations should maintain a standing digital-forensics response capability (the SHARE Foundation model) to triage Apple/Google threat notifications quickly
• Push for export-control and procurement transparency on commercial spyware and forensic-extraction vendors (Cellebrite, NSO Group) sold to states lacking independent oversight
• Support independent judicial oversight and public disclosure requirements for BIA/police use of intrusion and forensic-extraction tools

Affected and fixed versions

• Apple — iOS / iPadOS (iPhone)
  Vulnerable versions: iOS/iPadOS prior to 18.4.1
  Fixed in: iOS 18.4.1; iPadOS 18.4.1; macOS Sequoia 15.4.1; tvOS 18.4.1; visionOS 2.4.1; watchOS 11.5
• Google — Android (Linux kernel USB subsystem)
  Vulnerable versions: Android devices with kernels not carrying the December 2024/January 2025 upstream Linux USB fixes
  Fixed in: Android Security Bulletin, February 2025
• Qualcomm — Snapdragon DSP driver (adsprpc)
  Vulnerable versions: Devices with unpatched adsprpc driver
  Fixed in: Qualcomm security patch for CVE-2024-43047
• Samsung — Galaxy A32
  Vulnerable versions: Documented exploited unit (2025 Cellebrite chain case)
  Fixed in: Device patched with February 2025 Android security bulletin

Timeline of Pegasus NoviSpy Serbian campaign

Last updated 2026-09-05 · 2 updates · revalidated 2× · latest source

Showing the 20 most recent tracked events.

• 2024-10-08 Qualcomm patches CVE-2024-43047, the adsprpc use-after-free zero-day exploited by Cellebrite/BIA, in its October 2024 Security Bulletin following Google Project Zero and Amnesty International collaboration.
• 2024-10-15 Environmental activist Nikola Ristić and a Krokodil organization activist are covertly infected with locked-ioc-37 following BIA interviews.
• 2024-11-01 A renovated concrete canopy collapses at the Novi Sad railway station, killing 16 people and triggering the student-led protest movement later targeted by this spyware campaign.
• 2024-12-16 Amnesty International's Security Lab publishes 'A Digital Prison,' revealing the locked-ioc-37 Android spyware and Serbian police/BIA use of locked-ioc-26 to unlock devices of journalist Slaviša Milanov and a Krokodil NGO activist during police interviews, and publishes indicators of compromise to GitHub.
• 2024-12-25 A 23-year-old Belgrade student protester's Samsung Galaxy A32 is compromised in roughly four minutes via Cellebrite's Turbo Link USB-emulation exploit chain (CVE-2024-53104, CVE-2024-53197, CVE-2024-50302), achieving root code execution and a full lockscreen bypass.
• 2025-01-18 Google receives Amnesty's technical findings and begins sharing Linux kernel USB-driver fixes with Android OEM partners ahead of public disclosure.
• 2025-02-20 Amnesty publishes a second research briefing describing a Cellebrite zero-day privilege-escalation chain (CVE-2024-53104, CVE-2024-53197, CVE-2024-50302) used to unlock a 23-year-old student activist's Samsung Galaxy A32 and attempt a locked-ioc-37 install; Cellebrite subsequently suspends the responsible Serbian customer's access.
• 2025-02-24 Cellebrite announces it has suspended use of its products by 'relevant customers' in Serbia following Amnesty International's disclosures of misuse.
• 2025-03-01 Serbia's student-led protest movement reaches its peak scale, with up to 325,000 participants demonstrating against the ruling Serbian Progressive Party (SNS).
• 2025-03-27 Amnesty and BIRN reveal that journalists Bogdana (pseudonym) and Jelena Veljković were targeted with locked-ioc-36 via Viber messages sent from a number linked to state telecom operator locked-ioc-32.
• 2025-04-16 Apple ships iOS 18.4.1, fixing CVE-2025-31200 (CoreAudio) and CVE-2025-31201 (RPAC/PAC bypass), which Apple's own advisory said were exploited in 'an extremely sophisticated attack against specific targeted individuals.'
• 2025-11-01 Tens of thousands protest in Novi Sad on the one-year anniversary of the railway station canopy collapse, sustaining the student-led movement that becomes the primary target of the 2026 spyware wave.
• 2025-12-01 A member of Serbia's student protest movement is infected with locked-ioc-36 via an iMessage zero-click exploit; Citizen Lab's forensic timeline places the infection window between December 2025 and January 2026.
• 2026-01-31 High-confidence locked-ioc-36 infection indicators on the protester's iPhone end, marking the close of the identified compromise window.
• 2026-03-29 Serbian local elections are held; the spyware campaign intensifies around the student movement's election-monitoring and opposition campaign activity.
• 2026-08-01 Apple sends mercenary-spyware threat notifications to 12 Serbian individuals, prompting the victims to contact the SHARE Foundation for forensic assistance.
• 2026-09-02 SHARE Foundation holds a press conference; student activist Jelena Kontić and three other students go public, alongside confirmation that a sitting MP and a local councilor were also targeted, bringing the total to at least 14 victims since December 2025.
• 2026-09-03 Green-Left Front MP Radomir Lazović confirms he was targeted; Serbia's BIA calls the allegations 'trivial sensationalism' and Parliament Speaker Ana Brnabić denies state involvement, while The Record publishes the consolidated investigation.
• 2026-09-04 29 Members of the European Parliament send a letter demanding Serbia's EU accession be slowed and conditioned on accountability, and calling on Commission President Ursula von der Leyen to cancel her planned visit to Belgrade.
• 2026-10-01 Serbia's planned early parliamentary elections are scheduled, forming the backdrop for continued targeting risk to civil society and opposition figures.

Update history

• 2026-09-05 — EU Parliament Demands Serbia Accession Consequences Over locked-ioc-36/locked-ioc-37 Spyware Use Against Activists: What changed Severity, exploitability, and status unchanged (HIGH / ACTIVE / ACTIVE). The material change is diplomatic escalation: on 2026-09-04, 29 MEPs formally demanded Serbia's EU accession process be slowed and conditioned on accounta
• 2026-09-03 — locked-ioc-36 and locked-ioc-37 Spyware Used Against Serbian Protesters via iMessage Zero-Click Exploit (CVE-2025-31200/CVE-2025-31201): What changed No severity/exploitability/status change (both HIGH/ACTIVE/ACTIVE). CVSS score filled in as 9.8 (CVSS:3.1) for the CVE-2025-31200/31201 chain, previously null on the existing record. New indicators (9) Indicator values are with

Sources cited for Pegasus NoviSpy Serbian campaign

• Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Attacks (CVE-2025-31200, CVE-2025-31201) The Hacker News · Advisory · 2025-04-17
• Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities commerce.gov · Advisory · 2021-11-03
• Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist citizenlab.ca · Research · 2026-09-03
• SHARE Foundation: Students and Opposition Politicians Targeted by Spyware sharefoundation.info · Research · 2026-09-02
• "A Digital Prison": Surveillance and the Suppression of Civil Society in Serbia securitylab.amnesty.org · Research · 2024-12-16
• Cellebrite Zero-Day Exploit Used to Target Phone of Serbian Student Activist securitylab.amnesty.org · Research · 2025-02-20
• Pegasus for iOS, Software S0289 MITRE · Research · 2026-09-03
• AmnestyTech investigations: 2024-12-16_serbia_novispy (Indicators of Compromise) GitHub · Code repository · 2024-12-16
• Serbian spyware targeting expands ahead of elections The Record · News · 2026-09-03
• Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Activists The Hacker News · News · 2026-09-03
• Serbian Police Used Cellebrite Zero-Day Hack to Unlock Android Phones BleepingComputer · News · 2025-02-28
• New NoviSpy Android Spyware Exploits Zero-Day Flaw in Qualcomm Chips cyberinsider.com · News · 2024-12-16
• Opposition and Student Activists in Serbia Targeted With Advanced Spyware europeanwesternbalkans.com · News · 2026-09-03

Threats related to Pegasus NoviSpy Serbian campaign

• Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Member
• NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions for Pegasus Spyware Vendor
• Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human Rights Defenders (NSO Group)