Loading threat actor…
NSO Group is an Israeli private-sector offensive actor and commercial spyware vendor best known for developing Pegasus, a highly sophisticated surveillance platform used in targeted operations against mobile devices. The company has also been associated with the Android spyware Chrysaor and related Pegasus tooling and infrastructure. NSO Group markets its capabilities to government customers, while multiple investigations and legal actions have linked its products to surveillance of journalists, human rights defenders, activists, dissidents, diplomats, politicians, lawyers, and other members of civil society across numerous countries. Pegasus operations attributed to NSO Group and its customers have repeatedly relied on advanced exploit chains, including zero-click compromises delivered through messaging and communications services such as iMessage and WhatsApp. Publicly documented Pegasus exploit chains include FORCEDENTRY, BLASTPASS, FINDMYPWN, PWNYOURHOME, LATENTIMAGE, KISMET, Dragonfly, Diablo, and other vectors targeting Apple and Android ecosystems. Documented infection methods have included malicious message content, one-click phishing and spearphishing, network injection, and other covert delivery mechanisms. Technical reporting has shown Pegasus capable of device fingerprinting, privilege escalation, persistence, anti-forensics, self-removal, credential and data collection, microphone and camera activation, geolocation tracking, screenshot capture, keylogging on Android, and broad exfiltration from communications apps, email, browser data, contacts, calendars, calls, messages, and cloud-linked data. NSO Group has operated anonymized, customer-segregated infrastructure for Pegasus and maintained dedicated support functions for covert service delivery. Reporting has described a dedicated White Services function and a Pegasus Anonymizing Transmission Network used to provision distinct infrastructure for individual government clients. Researchers have used recurring forensic artifacts, exploit behavior, and infrastructure patterns to attribute multiple campaigns to Pegasus and, in some cases, to distinguish separate customer environments. The actor is widely associated with mercenary spyware activity rather than conventional financially motivated cybercrime. High-profile reporting and litigation have tied NSO Group activity to exploitation of WhatsApp users and to later phishing and social-engineering attempts targeting WhatsApp users despite court-imposed restrictions. NSO Group has been placed on the U.S. Entity List, and its operations have become a central example in debates over the commercial spyware industry, cyber-mercenary services, and transnational digital repression. Known aliases and related names include NSO, Pegasus, and Chrysaor. Pegasus is the company’s most widely recognized spyware platform rather than a separate threat actor identity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
38 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
The latest Pegasus spyware campaign targeted at least nine Bahraini activists, a French lawyer, and an Indian journalist via a new iOS exploit, dubbed FORCEDENTRY. This was a highly sophisticated zero-click, 0day vulnerability in iMessage, meaning it could be triggered without the intended victim either viewing the message sent by the threat actors or clicking the link contained in the message.
CVE-2019-3568: heap overflow в VOIP-стеке. Buffer overflow в VoIP-стеке WhatsApp - одна из первых публично задокументированных zero-click цепочек NSO Group... По данным WhatsApp/Meta... уязвимость использовалась против примерно 1400 устройств за двухнедельный период.
On information and belief, in order to enable Pegasus’ remote installation, Defendants exploited vulnerabilities in operating systems and applications (e.g., CVE-2016-4657) and used other malware delivery methods, like spearphishing messages containing links to malicious code.
Apple ... released emergency security updates ... to address two zero-day flaws that have been exploited in the wild to deliver NSO Group's Pegasus ... CVE-2023-41061 - A validation issue in Wallet that could result in arbitrary code execution when handling a maliciously crafted attachment.
CVE-2023-41064 - A buffer overflow issue in the Image I/O component that could result in arbitrary code execution when processing a maliciously crafted image.
1 more CVE tied to this actor tracked in Mallory.
290 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a known mercenary spyware vendor associated with Pegasus and prior iPhone zero-click exploitation, but not attributed to the August 2026 notification wave.
Commercial spyware vendor accused of enabling targeted mercenary spyware attacks against high-profile individuals through Pegasus spyware.
Mercenary spyware vendor operating Pegasus as an end-to-end surveillance platform for government clients, including anonymized delivery infrastructure, client-segregated operations, zero-click and one-click infection capabilities, device fingerprinting, and broad data exfiltration and active surveillance functions.
Commercial spyware operator/vendor whose customers deployed Pegasus spyware using at least three 2022 iPhone zero-click exploit chains: LATENTIMAGE, FINDMYPWN, and PWNYOURHOME, including attacks against Mexican civil society and human rights defenders.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.