Pegasus Strikes the Investigator: EP Member Compromised While Probing Spyware Abuse
The irony in the recent Citizen Lab report is palpable. Stelios Kouloglou, a former Member of the European Parliament serving on the PEGA committee, had his device repeatedly compromised by NSO Group’s Pegasus spyware. It highlights a critical reality: no amount of bureaucratic oversight stops a zero-click exploit chain targeting an unpatched vulnerability.
Forensic analysis suggests the attackers likely utilized WebKit or graphics execution flaws to gain initial access without user interaction. For those of us handling high-risk profiles, standard MDM isn't enough. We need granular telemetry.
I always recommend the Mobile Verification Toolkit (MVT) for deep-dive forensics. If you have an iOS lockdown record, you can scan for suspicious process launches or injection artifacts:
# Install MVT
pip install mvt
# Analyze iOS logs for suspicious activity
mvt-ios check-fs --backup /path/to/backup --output ./forensics_report
# Extract specific timeline indicators
mvt-ios check-backup --iocs /path/to/stix2. --backup /path/to/backup
Given that Pegasus can silently exfiltrate mic, camera, and encrypted comms (WhatsApp/Signal), how is everyone handling "High Risk" user policies? Is enabling Lockdown Mode mandatory for your execs now, or does the usability kill adoption?
Lockdown Mode is the only layer that actually stops these zero-click WebKit exploits effectively by disabling JIT compilation. We enforce it for our legal team. For detection, purely relying on endpoint agents is futile if the exploit is at the kernel level. We use network anomaly detection to flag 'heartbeat' traffic to known C2 infrastructure, though encryption makes that tough.
I've analyzed a few Pegasus-infested devices before. The persistence mechanisms are getting scary—often abusing legitimate daemons to mask activity. One tip: check for abnormal MobileInstallation logs on iOS. While MVT is great, don't ignore physical security. If they have physical access, the game is over regardless of the software patch level.
The supply chain of these zero-days is the real issue. Even if we patch the CVE today, they have three more in the queue. For our high-value targets, we've moved to "sandbox" phones—a primary device for comms and a burner device for authenticating accounts. It's not perfect, but it reduces the blast radius.
Zero-clicks often leave minimal disk artifacts, making memory forensics crucial for confirming the compromise before persistence mechanisms wipe traces. When analyzing devices like these, I focus on the WebContent process for injected shellcode. You can scan for unexpected RWX memory regions to catch the payload execution.
python vol.py -f image.dmp --profile=mac12_5_1 malfind -p
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access