# NSO Group Pegasus: Vendor Retained Exclusive Control of Infection Server Module and Technical Access to Data Harvested in Polish Government Operations

> Polish prosecutors and PM Donald Tusk stated that the Central Anti-Corruption Bureau (CBA) did not have full control over the Pegasus system it operated: NSO Group kept exclusive control of the server module that infects devices and had technical access to surveillance data, which was routed through foreign servers. Victims include opposition figures, Tusk's wife and daughter, and 500+ other people.

- **Published:** 2026-10-14T17:14:52Z
- **Last reviewed:** 2026-10-14T17:14:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3527
- **ID:** TL-2026-3527
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Central Anti-Corruption Bureau  operators (Poland)
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Pegasus, the mobile spyware developed by Israel-based NSO Group, was acquired by Poland's Central Anti-Corruption Bureau (CBA) in fall 2017 for 33.4 million zloty via the Polish intermediary Matic, which had bought it from NSO for 25 million zloty. It was used under the former Law and Justice (PiS) government against hundreds of targets, including political opponents.

According to The Record (Recorded Future News, 2026-10-14) and Notes from Poland, findings released by the National Prosecutor's Office on 2026-10-12 after an Internal Security Agency (ABW) analysis state that the CBA did not have full control over the system. The server module responsible for infecting mobile devices remained under the manufacturer's exclusive control, the CBA lacked passwords to accounts with administrative privileges, and NSO had full access during operational inspections. NSO also provided updates and technical support through a remote connection.

Data collected from infected phones was transmitted outside Poland through foreign IP addresses and an anonymizing network with servers abroad, beyond CBA control. Prosecutors confirmed NSO had technical access to materials from operational surveillance, but experts did not determine whether NSO actually accessed specific operational data. Notes from Poland reports multiple NSO-managed servers in various parts of the world.

Victims include opposition leaders, prosecutors, Tusk's wife and daughter, and lawyer/MP Roman Giertych. The sources cite over 500 targets (The Record) and nearly 600 (Notes from Poland, earlier reporting). Citizen Lab and Amnesty International Security Lab had earlier forensically confirmed Pegasus infections of Senator Krzysztof Brejza (33 times between April and October 2019), Roman Giertych (at least 18 times in 2019) and prosecutor Ewa Wrzosek. Text messages stolen from Brejza's phone were doctored and aired on state-controlled TV during the 2019 campaign.

No CVEs, exploit details, network indicators (IP addresses or domains) or CVSS score are published in the cited sources. This record is a governance, attribution and data-exposure finding for defenders, not an exploit analysis. No BeaconBeagle lookups were possible because no network IOC values were published. Polish authorities have since pursued charges: a former deputy justice minister was indicted in October 2025 and former security chiefs were charged in February 2026.

## MITRE ATT&CK

- T1588.002 Obtain Capabilities: Tool
- T1664 Exploitation for Initial Access
- T1636 Protected User Data
- T1090.003 Proxy: Multi-hop Proxy
- T1646 Exfiltration Over C2 Channel

## Sources

- [Spyware manufacturer had access to data harvested by former Polish government, current PM says](https://therecord.media/spyware-manufacturer-had-access-to-data-harvested-by-previous-polish-government)
- [Notes from Poland: Pegasus investigation findings](https://notesfrompoland.com/?p=105380)
- [Poland investigates use and misuse of Pegasus](https://andreafortuna.org/2024/05/13/poland-investigates-use-and-misuse-of-pegasus/)
- [Citizen Lab: phones of Roman Giertych and Ewa Wrzosek infected with Pegasus spyware](https://tvn24.pl/tvn24-news-in-english/citizen-lab-polish-attorney-and-prosecutor-were-infiltrated-by-pegasus-spyware-5535045)
- [Amnesty International verifies Polish senator was hacked with Pegasus spyware](https://www.pbs.org/newshour/world/amnesty-international-verifies-polish-senator-was-hacked-with-pegasus-spyware)
- [Polish leader admits country bought powerful Israeli spyware](https://www.bostonglobe.com/2022/01/07/world/polish-leader-admits-country-bought-powerful-israeli-spyware)
- [Prosecutor's office launches inquiry into hacking of senator Brejza's phone](https://tvn24.pl/tvn24-news-in-english/polish-prosecutors-office-launches-inquiry-into-hacking-of-senator-brejzas-phone-st5564256)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3527