Malware
malware:pegasus
Also: Pegasus malware, Pegasus spyware
Mobile spyware sold by NSO that can compromise phones, collect communications and sensor data, and transmit it to operators.
Mobile spyware sold by NSO that can compromise phones, collect communications and sensor data, and transmit it to operators.
“That’s what the Pegasus spyware is. It’s the malware that Citizen Lab discovered from Ahmed Mansoor’s text messages.”
Spyware delivered using an Android exploit associated in the episode with NSO.
“their delivery of Pegasus, the piece of spyware that has been all over the news lately”
Spyware made by NSO Group and discussed as a comparable mercenary spyware product.
“NSO Group makes spyware called Pegasus”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Citizen Lab | Explicit | 100 |
| outgoing | DISCOVERED_BY | Lookout Security | Explicit | 100 |
| outgoing | USES | zero-day exploit chain | Explicit | 100 |
| outgoing | USES | remote jailbreak | Explicit | 100 |
| outgoing | USES | Explicit | 100 | |
| outgoing | DEVELOPED_BY | NSO Group | Explicit | 100 |
| outgoing | DEVELOPED_BY | NSO Group | Explicit | 137 |
| outgoing | ASSOCIATED_WITH | Jamal Khashoggi | Uncertain | 100 |
| outgoing | USES | zero-click exploit | Explicit | 100 |
| outgoing | ATTRIBUTED_TO | NSO | Explicit | 127 |
| outgoing | USES | Android exploit used in the Pegasus chain | Explicit | 127 |
| incoming | USES | Mexico | Explicit | 100 |
| incoming | USES | Saudi Arabia | Explicit | 100 |
| incoming | INVOLVES | WhatsApp v. NSO Group litigation | Explicit | 100 |
| incoming | POSSIBLY_SAME_AS | Predator | Uncertain | 137 |
Pegasus DISCOVERED_BY Citizen Lab
Citizen Lab discovered and obtained a copy of Pegasus while investigating links sent to Ahmed Mansoor.
Explicit Confidence 96% · John Scott-Railton EP 100 Details
“we were actually able to grab the payload, the actual Pegasus deployment”
Pegasus DISCOVERED_BY Lookout Security
Lookout Security worked with Citizen Lab to investigate and dissect the newly discovered Pegasus malware.
Explicit Confidence 93% · Jack Rhysider EP 100 Details
“they teamed up with Lookout Security to help investigate this”
Pegasus USES zero-day exploit chain
Pegasus used a chain of previously unknown exploits against mobile devices.
Explicit Confidence 98% · John Scott-Railton EP 100 Details
“it’s using this chain of zero-days”
Pegasus USES remote jailbreak
The Pegasus infection remotely jailbroke the test iPhone.
Explicit Confidence 99% · John Scott-Railton EP 100 Details
“we had just observed a remote jailbreak on this iPhone”
Pegasus could read WhatsApp messages from an infected phone.
Explicit Confidence 97% · Jack Rhysider EP 100 Details
“read WhatsApp messages or listen to calls or track location”
Pegasus DEVELOPED_BY NSO Group
The episode presents Pegasus as the flagship spyware made and sold by NSO Group.
Explicit Confidence 99% · Jack Rhysider EP 100 Details
“It’s the flag ship software that NSO sells”
The episode says the Mexican government purchased Pegasus and that Mexican government or affiliated operators controlled it.
Explicit Confidence 98% · Jack Rhysider EP 100 Details
“NSO sold the tool to the Mexican government and from there, it’s now someone within the Mexican government or affiliated organization who has control of it”
Saudi Arabia USES Pegasus
Jack says NSO sold Pegasus to the Saudi government, while the episode also presents uncertainty about its use against Khashoggi and his associates.
Explicit Confidence 96% · Jack Rhysider EP 100 Details
“NSO has also sold their spyware to the government of Saudi Arabia”
Pegasus ASSOCIATED_WITH Jamal Khashoggi
The episode presents a theory that Saudi operators may have used Pegasus to spy on Khashoggi, but says his phone was not recovered and the claim is not certain.
Uncertain Confidence 82% · Jack Rhysider EP 100 Details
“the theory is that the Saudi government used Pegasus to spy on Khashoggi”
Pegasus USES zero-click exploit
The episode says NSO sold a zero-click WhatsApp exploit to customers as a way to deploy Pegasus without requiring the victim to click.
Explicit Confidence 96% · Jack Rhysider EP 100 Details
“NSO was in fact selling this exploit to its customers”
WhatsApp v. NSO Group litigation INVOLVES Pegasus
The WhatsApp litigation concerns the exploitation of users with Pegasus spyware.
Explicit Confidence 96% · Peter Dobbie EP 100 Details
“NSO has faced a number of lawsuits, one of them from WhatsApp”
“victims of Pegasus spyware”
Pegasus is described as spyware used by NSO; Jack also identifies NSO as the company behind and selling it.
Explicit Confidence 99% · Jack Rhysider EP 127 Details
“Pegasus is the spyware used by NSO”
“Pegasus is the spyware used by NSO, which is a company based in Israel”
Pegasus USES Android exploit used in the Pegasus chain
An Android exploit was used by NSO in the delivery chain for Pegasus.
Explicit Confidence 99% · Maddie Stone EP 127 Details
“NSO had this Android exploit that they were using to target Android users in their delivery of Pegasus”
Pegasus DEVELOPED_BY NSO Group
Jack says NSO Group makes Pegasus spyware.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“NSO Group makes spyware called Pegasus”
Predator POSSIBLY_SAME_AS Pegasus
The episode compares Predator and Pegasus as similar mercenary-spyware products, but does not assert that they are identical.
Uncertain Confidence 72% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”