Threat reportThreat IntelligenceTL-2026-3527
NSO Group Pegasus: Vendor Retained Exclusive Control of Infection Server Module and Technical Access to Data Harvested in Polish Government Operations
NSO Group Pegasus (TL-2026-3527), also tracked as Polish Pegasus scandal, is a high-severity tracked intrusion set, first published 2026-10-14. It is attributed to Central Anti-Corruption Bureau operators (Poland) with high confidence, affects NSO Group Pegasus spyware (mobile devices), maps to 5 MITRE ATT&CK techniques (T1090.003, T1588.002, T1636), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 2Central Anti-Corruption Bureau operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3527
- Threat ID
- TL-2026-3527
- Also known as
- Polish Pegasus scandal, CBA Pegasus affair
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Central Anti-Corruption Bureau operators, NSO Group
- Attribution confidence
- HIGH
- Nation-state nexus
- Poland
- Motivation
- ESPIONAGE
- Target sectors
- government administration, legal, political opposition, judiciary
- Target regions
- poland, Europe
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in NSO Group Pegasus
Malware and tooling: Chrysaor, Pegasus infection server module
How NSO Group Pegasus works
Polish prosecutors and PM Donald Tusk stated that the Central Anti-Corruption Bureau (CBA) did not have full control over the Pegasus system it operated: NSO Group kept exclusive control of the server module that infects devices and had technical access to surveillance data, which was routed through foreign servers. Victims include opposition figures, Tusk's wife and daughter, and 500+ other people.
Pegasus, the mobile spyware developed by Israel-based NSO Group, was acquired by Poland's Central Anti-Corruption Bureau (CBA) in fall 2017 for 33.4 million zloty via the Polish intermediary Matic, which had bought it from NSO for 25 million zloty. It was used under the former Law and Justice (PiS) government against hundreds of targets, including political opponents.
According to The Record (Recorded Future News, 2026-10-14) and Notes from Poland, findings released by the National Prosecutor's Office on 2026-10-12 after an Internal Security Agency (ABW) analysis state that the CBA did not have full control over the system. The server module responsible for infecting mobile devices remained under the manufacturer's exclusive control, the CBA lacked passwords to accounts with administrative privileges, and NSO had full access during operational inspections. NSO also provided updates and technical support through a remote connection.
Data collected from infected phones was transmitted outside Poland through foreign IP addresses and an anonymizing network with servers abroad, beyond CBA control. Prosecutors confirmed NSO had technical access to materials from operational surveillance, but experts did not determine whether NSO actually accessed specific operational data. Notes from Poland reports multiple NSO-managed servers in various parts of the world.
Victims include opposition leaders, prosecutors, Tusk's wife and daughter, and lawyer/MP Roman Giertych. The sources cite over 500 targets (The Record) and nearly 600 (Notes from Poland, earlier reporting). Citizen Lab and Amnesty International Security Lab had earlier forensically confirmed Pegasus infections of Senator Krzysztof Brejza (33 times between April and October 2019), Roman Giertych (at least 18 times in 2019) and prosecutor Ewa Wrzosek. Text messages stolen from Brejza's phone were doctored and aired on state-controlled TV during the 2019 campaign.
No CVEs, exploit details, network indicators (IP addresses or domains) or CVSS score are published in the cited sources. This record is a governance, attribution and data-exposure finding for defenders, not an exploit analysis. No BeaconBeagle lookups were possible because no network IOC values were published. Polish authorities have since pursued charges: a former deputy justice minister was indicted in October 2025 and former security chiefs were charged in February 2026.
MITRE ATT&CK techniques used in TL-2026-3527
Command and Control
T1090.003 Proxy: Multi-hop Proxy
Resource Development
T1588.002 Obtain Capabilities: Tool
Collection
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in NSO Group Pegasus
- NSO Group — Pegasus spyware (mobile devices)
Vulnerable versions: Devices targeted by CBA Pegasus operations 2017-2022; specific OS versions not stated in sources
Remediation for NSO Group Pegasus
Patches
- No CVE or vendor patch is cited in the sources; apply current iOS/Android and app security updates
Immediate actions
- High-risk individuals (politicians, lawyers, prosecutors, journalists) should enable Lockdown Mode on iOS or equivalent hardening on Android and reboot devices regularly
- Respond promptly to Apple and WhatsApp threat notifications and submit suspect devices for forensic review (Citizen Lab, Amnesty Security Lab)
- Screen for Pegasus traces with Amnesty's Mobile Verification Toolkit (MVT) using the public indicator sets
Workarounds
- Use a dedicated, minimal-app device for sensitive communications and disable unneeded messaging and iMessage features where risk is high
Longer-term hardening
- Government customers of commercial spyware should contractually and technically ensure sole control of infrastructure, administrative credentials and data storage
- Require independent oversight and audit of lawful-intercept tooling, including data egress paths and vendor remote access
- Keep mobile OS and messaging apps patched to reduce zero-click exposure
Timeline of NSO Group Pegasus
- Poland's CBA acquires Pegasus in fall 2017 for 33.4 million zloty via intermediary Matic, which bought it from NSO Group for 25 million zloty.
- Citizen Lab later determines Senator Krzysztof Brejza's phone was infected 33 times between April and October 2019 during the parliamentary election campaign; Roman Giertych was infected at least 18 times in 2019 (date shown is end of the infection window).
- Citizen Lab and Amnesty Security Lab publicly confirm Pegasus infections of Brejza, Giertych and prosecutor Ewa Wrzosek.
- Law and Justice leader Jaroslaw Kaczynski acknowledges Poland bought Pegasus, after earlier denials by allies.
- Coalition led by Donald Tusk takes office and begins investigating the Pegasus program (month-level source date, December 2023).
- Government confirms Pegasus use against victims and a special parliamentary commission is established (February 2024).
- A former deputy justice minister is indicted in connection with the Pegasus case (October 2025, per Notes from Poland).
- Former security chiefs are charged (February 2026, per Notes from Poland).
- National Prosecutor's Office releases findings from ABW analysis: NSO kept exclusive control of the infection server module and had technical access to operational surveillance materials; data was routed via foreign servers.
- The Record reports PM Tusk's statement that the CBA lacked full control, with 500+ additional targets including Tusk's wife and daughter.
Sources cited for NSO Group Pegasus
- Spyware manufacturer had access to data harvested by former Polish government, current PM says
- Notes from Poland: Pegasus investigation findings
- Poland investigates use and misuse of Pegasus
- Citizen Lab: phones of Roman Giertych and Ewa Wrzosek infected with Pegasus spyware
- Amnesty International verifies Polish senator was hacked with Pegasus spyware
- Polish leader admits country bought powerful Israeli spyware
- Prosecutor's office launches inquiry into hacking of senator Brejza's phone
Detection coverage for TL-2026-3527
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3527 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.