Pegasus Spyware Targeting European Officials — Mobile Threat Detection and IR Strategy

Introduction

The recent disclosure by Citizen Lab regarding the infection of former European Parliament Member Stelios Kouloglou with NSO Group’s Pegasus spyware is a stark reminder of the capabilities of modern mercenary surveillanceware. The target was not a random high-net-worth individual, but a legislator specifically tasked with investigating the abuse of these exact tools within the European Union. This targeting demonstrates that actors utilizing these capabilities are actively monitoring and attempting to blind the very bodies designed to oversee them.

For Security Operations Centers (SOCs) and Incident Responders, this highlights a critical gap: mobile endpoints often remain outside the traditional visibility horizon. Pegasus represents a "nation-state in a box" threat, utilizing zero-day exploits (often zero-click) to achieve full device compromise—microphone, camera, GPS, and encrypted messaging applications—without user interaction.

Technical Analysis

Threat Actor/Tool: NSO Group Pegasus (Commercial Surveillance Tool).

Affected Platforms: iOS and Android.

Attack Vector:

• Zero-Click Exploits: The report indicates repeated hacking, suggesting the use of zero-click exploits via messaging protocols (e.g., iMessage, WhatsApp) where the device is compromised simply by receiving a malformed packet, requiring no user interaction.
• Spear-Phishing (One-Click): Alternative vector involving SMS or messaging links luring the target to click.

Capabilities (Post-Exploitation):

• Persistence: Deep integration with the OS kernel to maintain persistence across reboots and updates.
• Data Exfiltration: Harvesting of Signal, WhatsApp, Telegram databases, GPS history, and microphone recordings.
• Self-Destruct: Capabilities to wipe traces of the malware if forensic detection is suspected.

CVEs: While specific CVE identifiers are not disclosed in this specific report, these tools typically exploit chains involving recent zero-day vulnerabilities in core components like WebKit or the graphics stack. Defenders should assume unpatched vectors are currently in the wild.

Detection & Response

Detecting Pegasus is notoriously difficult due to its "stealth" design. Traditional mobile antivirus is often bypassed. Defense relies on Mobile Threat Defense (MTD) solutions, network telemetry, and endpoint forensic artifacts.

SIGMA Rules

These rules target network indicators often associated with C2 beaconing and data exfiltration on the corporate network, and process anomalies on workstations used to sync mobile data.

---
title: Potential Mobile Spyware C2 Beaconing
id: 85d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential mobile spyware C2 traffic characterized by high-frequency connections to non-standard ports or low-data-volume keep-alives from mobile user agents.
references:
  - https://citizenlab.ca
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort|between:
      - 1
      - 1024
  filter_legit_traffic:
    DestinationPort:
      - 80
      - 443
      - 8080
  condition: selection and not filter_legit_traffic
falsepositives:
  - Legitimate mobile apps using non-standard ports
level: high
---
title: Mobile Device PnP Connection (Lateral Movement Risk)
id: 92e1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects a mobile device (iPhone/Android) connecting to a workstation via USB, which can be a vector for bridging compromises or staging forensic tools.
references:
  - https://attack.mitre.org/techniques/T1200/
author: Security Arsenal
date: 2026/07/14
tags:
  attack.initial_access
  - attack.t1200
logsource:
  product: windows
  service: microsoft-windows-driverframeworks-usermode/operational
detection:
  selection:
    EventID: 1003, 1010, 1011, 2003, 2004
    DeviceName|contains:
      - 'Apple'
      - 'Android'
      - 'ADB'
falsepositives:
  - Legitimate charging or syncing by user
level: low

KQL (Microsoft Sentinel / Defender)

Hunt for mobile devices communicating with known infrastructure or exhibiting anomalous data transfer patterns.

// Hunt for anomalous high-egress traffic from mobile segments or User-Agents
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionAllowed"
// Filter for common mobile user agents (simplified)
| where DeviceName contains "iPhone" or DeviceName contains "Android" or RequestFields has "Mobile"
// Summarize data volume by remote IP
| summarize TotalBytes = sum(SentBytes + ReceivedBytes), ConnectionCount = count() by RemoteIP, RemotePort, DeviceName
| where TotalBytes > 50000000 // > 50MB
| where ConnectionCount > 100
| project Timestamp, DeviceName, RemoteIP, RemotePort, TotalBytes, ConnectionCount
| order by TotalBytes desc

Velociraptor VQL

In an IR engagement, we often acquire an iTunes backup instead of the raw device filesystem. This VQL artifact hunts within the backup manifest for suspicious application installations or database modifications.

-- Hunt for suspicious mobile backup artifacts
SELECT FullPath, Size, Mtime
FROM glob(globs="/**/*")
WHERE FullPath =~ "MobileSMS/"
   OR FullPath =~ "WhatsApp/"
   OR FullPath =~ "Telegram/"
-- Limit search to known Pegasus drop locations or suspicious config plist
-- This is a heuristic to locate databases of interest for deeper forensic carving

Remediation Script (PowerShell)

While we cannot patch the mobile device directly from PowerShell, we can audit the environment for devices that have recently interacted with high-risk systems or ensure local workstations are hardened against USB-based lateral movement from compromised phones.

# Audit for recent Mobile Device Plug-in Events (Last 24 Hours)
# Used to identify workstations that may have been bridged to a compromised mobile device.

$Events = Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-DriverFrameworks-UserMode/Operational';
    ID=1003, 2003, 2004;
    StartTime=(Get-Date).AddHours(-24)
} -ErrorAction SilentlyContinue

if ($Events) {
    Write-Host "[!] Detected recent mobile device connections:" -ForegroundColor Yellow
    $Events | Select-Object TimeCreated, Id, Message | Format-Table -Wrap
    
    # Recommendation logic could go here to trigger an isolation ticket
} else {
    Write-Host "[+] No mobile device connections detected in the last 24 hours." -ForegroundColor Green
}

# Check if USB storage/ports are restricted (Best Practice)
$USBStatus = Get-BitLockerVolume -MountPoint C: | Select-Object VolumeStatus, ProtectionStatus
Write-Host "[+] Current Volume Protection Status:"
$USBStatus

Remediation

Given the sophistication of Pegasus, standard "cleaning" is often insufficient. The NSA and other intelligence agencies recommend assuming the device is permanently compromised.

1. Immediate Isolation: Device isolation (Airplane mode) is the first step to prevent further data exfiltration or remote wiping by the actor.
2. Device Replacement: For high-value targets (HVTs), the only guaranteed remediation is physical destruction or disposal of the device and SIM card. Do not reuse the device.
3. Enable Lockdown Mode: For iOS devices in the organization, enforce "Lockdown Mode" (introduced in iOS 16/17). This strictly restricts web browsing and messaging functionalities to block known exploit classes used by spyware.
4. Mobile Threat Defense (MTD): Deploy an MTD solution (e.g., Microsoft Defender for Endpoint, Zimperium, Lookout) that can detect OS-level anomalies, root/Jailbreak attempts, and malicious profiles.
5. Credential Reset: Assume all authenticated sessions on the device (O365, VPN, MFA tokens) are compromised. Revoke all sessions and require a full MFA reset.
6. Update and Patch: Ensure all remaining mobile devices are on the absolute latest OS version. Pegasus relies on unpatched zero-days; closing the window is critical.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub