# Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and Student Protesters

> Serbian authorities used NSO Group's Pegasus (iMessage zero-click) and the domestically-linked NoviSpy Android spyware (Cellebrite UFED-enabled physical install) to target at least 14 Serbians since December 2025, including MP Radomir Lazović, student activist Jelena Kontić, a local councilor, and journalists. Citizen Lab and Amnesty International's Security Lab confirmed the infections; Apple issued threat notifications to 12 victims in August 2026. Serbia's BIA denies involvement.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-05T04:08:28.563Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2316
- **ID:** TL-2026-2316
- **Severity:** HIGH (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Serbia Security Information Agency (Serbia)
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-31200, CVE-2025-31201, CVE-2024-53104, CVE-2024-53197, CVE-2024-50302, CVE-2024-43047

## Description

Since December 2025, at least 14 Serbian civil society members, opposition figures, and journalists have been targeted with commercial spyware in a campaign that SHARE Foundation calls the largest documented wave of surveillance in the country to date. A member of Serbia's student protest movement had their iPhone infected with NSO Group's Pegasus via an iMessage zero-click exploit requiring no user interaction; Citizen Lab confirmed the infection with high confidence and tied the exploit to the vulnerability class Apple closed in iOS 18.4.1. Two additional devices were confirmed infected with a new variant of NoviSpy, a bespoke Android spyware system first documented by Amnesty International in December 2024 and previously linked by forensic evidence (C2 configuration data) to a BIA (Bezbednosno-informativna agencija, Serbia's Security Information Agency) employee with a history of procuring Hacking Team Android spyware. Apple sent mercenary-spyware threat notifications to 12 of the 14 known victims in August 2026, prompting several to come forward publicly at a September 2, 2026 SHARE Foundation press conference, including student activist Jelena Kontić; on September 3, Green-Left Front MP Radomir Lazović confirmed he was also targeted.

The campaign continues a documented pattern stretching back to November 2023, when Amnesty, Access Now, SHARE Foundation, and Citizen Lab first jointly confirmed zero-click Pegasus infections of Serbian civil society members. In December 2024, Amnesty's 'A Digital Prison' report revealed that Serbian police and BIA had been using Cellebrite UFED forensic-extraction hardware to unlock confiscated Android phones during detentions and covertly install NoviSpy — documenting cases against journalist Slaviša Milanov and a Krokodil NGO activist. In February 2025, Amnesty disclosed that this install chain relied on a then-undisclosed Cellebrite zero-day (a Linux kernel USB Video Class privilege-escalation bug, CVE-2024-53104, alongside related USB-stack flaws CVE-2024-53197 and CVE-2024-50302) used against a 23-year-old student activist's Samsung Galaxy A32; Cellebrite subsequently cut off the responsible Serbian customer. A parallel Qualcomm DSP driver use-after-free (CVE-2024-43047, adsprpc) was also documented in NoviSpy tradecraft. In March 2025, two BIRN investigative journalists were separately targeted with Pegasus via Viber messages sent from a number linked to state operator Telekom Srbija.

The targeting has consistently coincided with Serbian electoral and protest cycles: the current wave overlaps the March 29, 2026 local elections and the anti-government student protest movement that grew out of the 2024 Novi Sad railway-station canopy collapse, and continues ahead of early parliamentary elections expected in October 2026. Serbia's BIA dismissed the allegations as 'trivial sensationalism' serving 'foreign intelligence services,' and Parliament Speaker Ana Brnabić denied state involvement, calling it implausible that a state actor using million-euro spyware would leave forensic traces. NSO Group, the Pegasus developer, has been on the U.S. Commerce Department's Entity List since November 2021 for supplying spyware used to target journalists, activists, and dissidents; it did not respond to requests for comment.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1456 Drive-By Compromise
- T1660 Phishing
- T1461 Lockscreen Bypass
- T1658 Exploitation for Client Execution
- T1645 Compromise Client Software Binary
- T1624.001 Broadcast Receivers
- T1404 Exploitation for Privilege Escalation
- T1429 Audio Capture
- T1512 Video Capture
- T1430 Location Tracking
- T1636.002 Call Log
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1409 Stored Application Data
- T1644 Out of Band Data
- T1426 System Information Discovery
- T1421 System Network Connections Discovery
- T1626.001 Abuse Elevation Control Mechanism
- T1398 Boot or Logon Initialization Scripts
- T1541 Foreground Persistence
- T1629.001 Impair Defenses
- T1418 Software Discovery
- T1422 System Network Configuration Discovery
- T1453 Abuse Accessibility Features
- T1513 Screen Capture
- T1646 Exfiltration Over C2 Channel
- T1628 Hide Artifacts
- T1417 Input Capture
- T1420 File and Directory Discovery
- T1481 Web Service

## Sources

- [Serbian spyware targeting expands ahead of elections](https://therecord.media/serbia-spyware-pegasus-europe)
- [Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist](https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/)
- [SHARE Foundation: Students and Opposition Politicians Targeted by Spyware](https://sharefoundation.info/en/share-foundation-students-and-opposition-politicians-targeted-by-spyware/)
- ["A Digital Prison": Surveillance and the Suppression of Civil Society in Serbia](https://securitylab.amnesty.org/latest/2024/12/a-digital-prison-surveillance-and-the-suppression-of-civil-society-in-serbia/)
- [Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Activists](https://thehackernews.com/2026/09/pegasus-zero-click-spyware-exploit.html)
- [Cellebrite Zero-Day Exploit Used to Target Phone of Serbian Student Activist](https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/)
- [Serbian Police Used Cellebrite Zero-Day Hack to Unlock Android Phones](https://www.bleepingcomputer.com/news/security/serbian-police-used-cellebrite-zero-day-hack-to-unlock-android-phones/)
- [AmnestyTech investigations: 2024-12-16_serbia_novispy (Indicators of Compromise)](https://github.com/AmnestyTech/investigations/tree/master/2024-12-16_serbia_novispy)
- [New NoviSpy Android Spyware Exploits Zero-Day Flaw in Qualcomm Chips](https://cyberinsider.com/new-novispy-android-spyware-exploits-zero-day-flaw-in-qualcomm-chips)
- [Opposition and Student Activists in Serbia Targeted With Advanced Spyware](https://europeanwesternbalkans.com/2026/09/03/opposition-and-student-activists-in-serbia-targeted-with-advanced-spyware/)
- [Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Attacks (CVE-2025-31200, CVE-2025-31201)](https://thehackernews.com/2025/04/apple-patches-two-actively-exploited.html)
- [Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities](https://www.commerce.gov/news/press-releases/2021/11/commerce-adds-nso-group-and-other-foreign-companies-entity-list)
- [Pegasus for iOS, Software S0289](https://attack.mitre.org/software/S0289/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2316