Mercenary Spyware Resurgence: Pegasus and NoviSpy Wave Targets Civil Society in Southeastern Europe

Executive Summary

Recent investigations by digital rights researchers have uncovered a targeted mobile surveillance campaign actively leveraging commercial mercenary spyware against activists and civil society organizations in Southeastern Europe. Forensic analyses verified successful intrusions involving NSO Group's Pegasus implant alongside an evasive new variant of the domestic Android spyware known as NoviSpy. The campaign came to light following Apple's extensive wave of threat notifications sent to targeted users across 110 countries, underscoring the ongoing threat posed by zero-click exploit chains and the commercial spyware industry against high-value targets.

Threat Analysis

The identified intrusions highlight an orchestrated digital surveillance effort timed closely with regional political mobilization. At least 14 individuals—including student leaders, opposition figures, and investigative journalists—were singled out. Unlike standard cybercriminal malware, mercenary spyware attacks feature extremely narrow targeting, persistent operator monitoring, and the use of zero-day vulnerabilities designed to execute without requiring victim interaction.

Technical Details

Forensic examination confirmed that Pegasus was deployed using an iMessage-based zero-click exploit chain capable of compromising recent mobile firmware without user interaction. Indicators of compromise confirmed malicious persistence and execution windows that bypassed legacy defenses:

• Exploit Vector: Zero-click iMessage attachment processing vulnerability, facilitating remote code execution within mobile messaging sandboxes.
• Capabilities: Full device compromise granting operators access to encrypted application messages, stored local media, microphone and camera activation, real-time geolocation, and keystroke logging.
• NoviSpy Evolution: Concurrently, researchers identified a rebuilt version of NoviSpy, an Android-focused implant engineered to defeat modern heuristic and static detection methods. The payload features hardened command-and-control (C2) obfuscation and exfiltrates structured telemetric and personal data directly to remote servers.

Apple has addressed the core zero-click messaging flaw in recent updates, notably iOS 18.4.1.

Attribution Assessment

With high confidence, the primary iOS surveillance payloads are attributed to NSO Group's Pegasus framework, sold commercially to government security agencies. The secondary Android component, NoviSpy, has historical ties to domestic security operations, with prior samples routing exfiltrated telemetry through domestic intelligence service network infrastructure. The simultaneous deployment of specialized commercial tools and custom domestic implants indicates a coordinated state-aligned intelligence-gathering apparatus.

Implications

This wave illustrates that despite escalating international export restrictions, regulatory sanctions, and public disclosures, the global mercenary surveillance market remains viable and lethal. High-tier zero-click exploits continue to be weaponized against democratic processes, opposition elements, and independent media. Exploits developed for state surveillance often proliferate, eventually surfacing in wider threat actor ecosystems or triggering rapid reverse-engineering by hostile advanced persistent threat (APT) groups.

Recommendations

Organizations operating in high-risk environments or supporting sensitive personnel should adopt immediate defensive mitigations:

• Enable Lockdown Mode: High-risk iOS users should immediately turn on Apple's Lockdown Mode to restrict aggressive message attachment parsing and sandbox behaviors.
• Immediate Patching: Ensure all mobile operating systems are patched immediately to the latest available releases (iOS 18.4.1+ and current Android security bulletin patch levels).
• Device Hygiene: Conduct regular reboot cycles to flush non-persistent memory implants, audit third-party application permissions (especially camera, mic, and accessibility access), and seek verification via accredited incident responders upon receiving official threat notifications.