Actor Profile

NSO Group is an Israeli cyber intelligence company that develops and sells Pegasus, a sophisticated mobile surveillance platform marketed exclusively to government clients for lawful interception. The company has been linked to numerous cases of spyware abuse targeting journalists, activists, politicians, and dissidents globally. NSO Group maintains that its technology is intended for counterterrorism and law enforcement purposes, though its tools have been repeatedly documented in human rights violations. The group operates as a commercial surveillance vendor (CSV) or mercenary spyware provider, selling capabilities to state actors who deploy them against targets of interest.

TTPs (Tactics, Techniques, Procedures)

The attack leveraged an iMessage zero-click exploit to deliver Pegasus spyware without user interaction, likely corresponding to techniques including Initial Access via Exploit Public-Facing Application (T1190) or Drive-by Compromise (T1189), and Execution via Exploitation for Client Execution (T1203). The zero-click nature indicates use of memory corruption or logic flaws requiring no victim action. The exploit targeted iOS versions prior to 18.4.1 (patched April 2025). Infection indicators were detected across December 2025 through January 2026. Separately, Serbian authorities deployed NoviSpy Android spyware via physical device access during police detention, representing Physical Access (T1200) and potentially Modify System Image (T1601) techniques. A new Android spyware variant with detection evasion capabilities was also identified, suggesting Defense Evasion (T1562) and Obfuscated Files or Information (T1027) techniques.

Targets & Patterns

Targets included members of Serbia's student protest movement, activists, opposition party members of parliament, and local councilors—at least 14 individuals since early 2026. The targeting pattern aligns with political surveillance during a sensitive period coinciding with Serbian local elections on March 29, 2026. Victims represent civil society actors challenging government authority through protests and political opposition. The selection criteria indicate state-sponsored surveillance of domestic dissent rather than counterterrorism or criminal investigation. One victim's private Viber messages were subsequently disclosed on Informer TV, a pro-government Serbian media outlet, suggesting surveillance objectives included intelligence collection for political advantage and potential intimidation. The dual use of commercial spyware (Pegasus) and locally-deployed tools (NoviSpy variants) indicates a multi-layered surveillance apparatus targeting high-value and opportunistic targets respectively.

Historical Context

This incident continues a documented pattern of surveillance technology abuse in Serbia, including previous use of Cellebrite forensic tools to deploy NoviSpy spyware. NSO Group's Pegasus has been implicated in dozens of cases globally targeting civil society, including journalists murdered in Mexico, Jamal Khashoggi's inner circle, Catalan politicians, and activists across multiple continents. Citizen Lab has tracked Pegasus deployments since 2016, documenting infections in over 45 countries. The Serbian cases follow NSO Group's addition to the U.S. Commerce Department Entity List in 2021 and ongoing legal challenges including WhatsApp's lawsuit. The use of zero-click iMessage exploits represents NSO Group's continued investment in sophisticated exploitation techniques despite increased scrutiny. The parallel deployment of locally-developed Android spyware (NoviSpy and its 2026 variant) suggests Serbian authorities maintain both commercial and indigenous surveillance capabilities, with physical access operations complementing remote exploitation.

Defensive Recommendations

  • Immediately update iOS devices to version 18.4.1 or later to patch the iMessage zero-click vulnerability exploited in this campaign; prioritize updates for high-risk users including activists, journalists, and political opposition members
  • Enable Apple Lockdown Mode on iOS devices for users at elevated risk of targeted spyware attacks; this feature disables attack surfaces including message attachment previews and complex web technologies
  • Conduct regular mobile device forensics using tools like MVT (Mobile Verification Toolkit) to detect Pegasus indicators of compromise, particularly for devices belonging to civil society actors in high-risk environments
  • Implement physical device security protocols to prevent opportunistic spyware installation during detention or confiscation events; use strong device encryption and biometric locks, and consider device replacement after any period of loss of custody
  • Monitor for Apple threat notifications and enroll high-risk users in Google's Advanced Protection Program (Android) or equivalent security features; establish incident response procedures for suspected mercenary spyware infections including immediate network isolation and forensic preservation

---

# Geopolitical Context

Geopolitical Context

The deployment of NSO Group's Pegasus spyware against Serbian student protest movement members represents a significant escalation in domestic surveillance tactics within Serbia. The targeting of at least 14 individuals—including student activists, opposition parliamentarians, and local councilors—during the period surrounding March 2026 local elections suggests a coordinated effort to monitor and potentially suppress political dissent. The use of sophisticated zero-click exploits alongside physical device compromise (NoviSpy installation during police detention) indicates a multi-layered surveillance apparatus. The subsequent disclosure of private Viber messages on pro-government television further points to intelligence collection being weaponized for political purposes. This pattern is consistent with authoritarian governance models that employ advanced surveillance technology to maintain control during periods of civil unrest and electoral competition.

State Actor Alignment

While NSO Group is an Israeli-based commercial surveillance vendor, its Pegasus spyware is sold exclusively to government clients under export licensing regimes. The infections documented by Citizen Lab and SHARE Foundation strongly suggest Serbian state authorities or affiliated entities acquired and deployed these capabilities. The parallel use of NoviSpy—installed during police questioning—provides additional evidence of state involvement, as physical access to devices during detention implicates law enforcement directly. Serbia is not currently subject to comprehensive international sanctions, though the EU has raised concerns about democratic backsliding and rule of law. NSO Group itself faces ongoing scrutiny from the U.S. Department of Commerce, which placed the company on the Entity List in 2021 for acting contrary to U.S. foreign policy and national security interests. The use of Cellebrite forensic tools, as referenced in prior incidents, further indicates procurement of Western surveillance technology by Serbian authorities.

Business Impacty pro region

This incident contributes to a broader pattern of surveillance technology proliferation across the Western Balkans, a region where EU accession processes have stalled amid governance concerns. For European institutions, the targeting of civil society and opposition figures in a candidate country raises questions about conditionality enforcement and the effectiveness of export controls on dual-use technologies. The case may prompt renewed calls within the European Parliament for stricter regulation of spyware vendors and greater accountability for member states that license such exports. Regionally, the incident could embolden other governments in Southeast Europe to adopt similar surveillance practices, particularly if international response remains muted. The involvement of Israeli technology in a European context also highlights transatlantic coordination gaps in controlling mercenary spyware markets. Civil society organizations across the region are likely to face heightened digital security risks, potentially chilling cross-border activism and investigative journalism.

Forecast

If Serbian authorities continue to face domestic political pressure from student movements and opposition groups, further deployment of surveillance tools appears likely, particularly around future electoral cycles or mass mobilization events. Should the EU escalate its response—through sanctions, export control enforcement, or conditioning accession negotiations on surveillance reform—Serbian procurement of Western spyware may become more difficult, though alternative suppliers from non-Western jurisdictions could fill the gap. If civil society documentation efforts like those by SHARE Foundation and Citizen Lab continue to expose these operations, international pressure on NSO Group and similar vendors may intensify, potentially leading to additional export restrictions or legal action in jurisdictions where victims hold citizenship or residency. The emergence of new Android spyware variants suggests an adaptive threat landscape; if detection capabilities do not keep pace, the scope and sophistication of targeting in Serbia and neighboring states is likely to expand.