Actor Profile

NSO Group is an Israeli commercial surveillance vendor that develops and sells Pegasus spyware exclusively to government clients and state agencies. The company provides mercenary spyware capabilities that enable full device compromise, including access to encrypted communications, camera, and microphone control. NSO operates under a government-sales-only model, positioning its tools as lawful intercept solutions for intelligence and law enforcement agencies. The group has been linked to numerous cases of spyware deployment against civil society targets globally, including journalists, activists, and political opposition figures.

TTPs (Tactics, Techniques, Procedures)

The infection leveraged a zero-click exploit requiring no user interaction (T1203 - Exploitation for Client Execution), delivering Pegasus spyware to the target's iPhone. Once installed, Pegasus provides comprehensive access equivalent to device ownership (T1417 - Input Capture on mobile), including exfiltration of private and encrypted messages (T1430 - Location Tracking, T1533 - Data from Local System on mobile), and enables surveillance through microphone and camera activation without user awareness (T1429 - Audio Capture, T1512 - Video Capture on mobile). The deployment timing—six days before a snap parliamentary election—and targeting pattern suggest intelligence collection operations (T1592 - Gather Victim Host Information) aligned with political surveillance objectives. The attack vector bypassed user-level security controls entirely, exploiting unknown iOS vulnerabilities.

Targets & Patterns

Targets include Serbian civil society figures with direct connections to political opposition and anti-corruption activities. Vladan Đokić, rector of the University of Belgrade and prominent supporter of student protest movements, was infected in 2026. Rade Bajić, a senior prosecutorial associate working on the "Generalštab" corruption investigation involving a Kushner-linked Belgrade property development, received Apple Threat Notifications indicating likely targeting. The broader campaign encompasses at least 16 individuals in Serbian civil society in 2026, including student activists, opposition politicians, a local councilor, and journalists. Targeting patterns align with state surveillance of dissent following the November 2024 railway station collapse that killed 16 people and sparked nearly two years of protests. The timing of Đokić's confirmed infection—immediately before the October 25 snap parliamentary election—suggests intelligence gathering on opposition-aligned figures during a politically sensitive period. Bajić's targeting coincides with his removal from a high-profile corruption case in November 2025, indicating potential surveillance of prosecutorial activities threatening government interests.

Historical Context

This operation extends a wave of mercenary spyware targeting in Serbia that SHARE Foundation first reported on September 2, 2026, identifying at least 14 people targeted since the start of that year. Twelve received Apple Threat Notifications in August 2026, when Apple warned users in 110 countries. Citizen Lab previously confirmed Pegasus infection of student activist Jelena Kontić in that wave. Two additional targets were infected with NoviSpy, an Android spyware variant that Amnesty International reported in December 2024 was configured to exfiltrate data to a server with an IP address belonging to Serbia's Security Information Agency (BIA). That report documented NoviSpy installation during police questioning after devices were unlocked using Cellebrite forensic tools. The BIA dismissed the September allegations as "purely trivial sensationalism" in a statement on September 3. Lawyers for Kontić filed a criminal complaint on October 6, 2026, against unidentified BIA and police individuals as well as NSO Group personnel, though SHARE notes that previous complaints over spyware in Serbia have brought no effective action. Police raided Đokić's offices on March 31, 2026, seizing computers and servers.

Defensive Recommendations

  • Enable iOS Lockdown Mode on all devices for high-risk individuals (politicians, activists, journalists, legal professionals) to block zero-click exploit vectors and maintain iOS updates immediately upon release
  • Treat Apple Threat Notifications as high-confidence indicators of compromise; immediately isolate the device, cease sensitive communications, and engage digital forensics experts such as SHARE Foundation or Access Now's Digital Security Helpline
  • Conduct proactive spyware screening for close contacts and professional associates of confirmed targets, as surveillance operations typically extend to communication networks surrounding primary targets
  • Implement organizational policies requiring forensic examination of devices following any police seizure, questioning, or physical access by state authorities, particularly when Cellebrite or similar mobile forensic tools may have been used
  • Monitor for behavioral indicators of mobile compromise including unusual battery drain, unexpected data usage, or device performance degradation, and establish secure out-of-band communication channels for sensitive political or legal work

---

# Geopolitical Context

Geopolitical Context

The confirmed Pegasus infection of Vladan Đokić, rector of the University of Belgrade and supporter of Serbia's student protest movement, occurred in 2026 shortly before snap parliamentary elections called in response to sustained civil unrest. The targeting appears consistent with a broader pattern of surveillance against Serbian civil society documented since early 2026, including at least 16 individuals linked to student activism, opposition politics, and sensitive corruption investigations. The timing—six days before the October 25 election—suggests potential use of commercial spyware to monitor or intimidate figures associated with anti-government protests that began following the November 2024 Novi Sad railway station collapse. A second case involves a prosecutor previously assigned to the "Generalštab" investigation into a Kushner-linked Belgrade property development, indicating possible surveillance of officials handling politically sensitive corruption cases. The deployment of NSO Group's Pegasus via zero-click exploit demonstrates sophisticated capabilities typically reserved for state-level operations.

State Actor Alignment

NSO Group's Pegasus is sold exclusively to government clients and state agencies. While Citizen Lab's investigation does not attribute the infections to a specific operator, Serbia's Security Information Agency (BIA) has been implicated in previous spyware incidents: Amnesty International reported in December 2024 that NoviSpy Android spyware was configured to exfiltrate data to BIA-controlled IP addresses and was installed on activists' and journalists' devices during police questioning using Cellebrite tools. The BIA dismissed September 2026 allegations of surveillance against students and opposition figures as "trivial sensationalism," asserting compliance with Serbian law. Criminal complaints filed in October 2026 name unidentified BIA and police personnel alongside NSO Group representatives, though no effective legal action has resulted from prior complaints. The pattern of targeting—encompassing protest leaders, opposition politicians, and prosecutors investigating government-linked corruption—is consistent with state-directed surveillance operations.

Business Impacty pro region

The Serbian cases contribute to growing evidence of Pegasus deployment across Central and Southeast Europe, raising concerns about rule-of-law erosion and democratic backsliding in EU candidate states. The targeting of a university rector and prosecutor handling corruption cases linked to U.S. political figures (Jared Kushner) may complicate Serbia's EU accession negotiations and transatlantic relations, particularly if Western governments perceive systematic abuse of surveillance tools against civil society. The incident occurs amid broader European debate over export controls and accountability mechanisms for commercial spyware vendors, with the European Parliament having established an inquiry committee on Pegasus in 2022. Serbia's apparent use of multiple spyware platforms (Pegasus, NoviSpy) alongside forensic tools (Cellebrite) suggests a layered surveillance infrastructure that may serve as a model—or warning—for neighboring Balkan states navigating between EU integration and authoritarian governance practices. Regional digital rights organizations, including SHARE Foundation, are increasingly coordinating cross-border documentation efforts, potentially strengthening civil society resilience networks across the Western Balkans.

Forecast

If Serbian authorities fail to conduct credible investigations into the documented spyware cases, international pressure from the EU and human rights organizations is likely to intensify, potentially affecting Serbia's accession timeline and access to EU funding mechanisms. Should additional infections be confirmed among opposition figures or journalists in the lead-up to or following the October 25 election, calls for targeted sanctions against Serbian officials or restrictions on spyware exports to Belgrade may gain traction in Brussels and Washington. If the criminal complaints filed in October yield no prosecutorial action, Serbian civil society groups will likely escalate cases to regional human rights bodies, including the European Court of Human Rights. The involvement of a prosecutor handling a Kushner-linked investigation may prompt U.S. congressional interest, particularly if evidence emerges of surveillance aimed at obstructing corruption probes with American connections. Broader adoption of Apple's Lockdown Mode and increased forensic screening by at-risk populations in Serbia and neighboring states appears probable, potentially reducing the operational effectiveness of zero-click exploits in the region over the medium term.