Loading threat actor…
KINGDOM is a Pegasus spyware operator assessed with high confidence to be linked to Saudi Arabia. The cluster is associated with NSO Group’s Pegasus platform and is known for targeting Saudi dissidents, journalists, activists, and civil society figures, including individuals located outside Saudi Arabia. Reported victims and targets include Ben Hubbard, Omar Abdulaziz, Ghanem Al-Masarir, Yahya Assiri, and an Amnesty International staff member or researcher. The operator’s activity is part of a broader pattern of transnational repression directed at critics of the Saudi state. KINGDOM has been tied to lure-based Pegasus delivery through SMS and WhatsApp messages containing malicious links, and successful compromise has been reported in multiple cases. The operator has been linked to targeting in Saudi Arabia as well as abroad, including Canada and the United Kingdom, and broader monitoring associated with the cluster has been observed across multiple countries in the Middle East, Europe, and North America. Operationally, KINGDOM is associated with initial access via social-engineering lures that impersonate news or service-related themes, followed by deployment of Pegasus to mobile devices. Once installed, Pegasus enables covert surveillance of communications, files, messages, photos, microphones, and cameras, supporting intelligence collection against political opponents and other persons of interest. Public reporting has also connected the cluster to targeting around the period of Jamal Khashoggi’s killing and to surveillance of individuals in contact with him. KINGDOM is also referred to as kingdom_hacker_crew. Available evidence supports characterization of the actor as a Saudi-linked espionage operator using commercial mercenary spyware for surveillance of dissidents, journalists, and human rights-related targets rather than for ransomware or financially motivated crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
22 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pegasus operator linked in the content to the Kingdom of Saudi Arabia, responsible for targeting Ben Hubbard in 2018 with SMS and WhatsApp lure messages carrying Pegasus infection links.
A Saudi-linked operator/activity cluster reported by Citizen Lab as conducting targeted surveillance against dissidents abroad using NSO Group’s Pegasus spyware, via malicious links/messages leading to iPhone infection.
Saudi Arabia-linked Pegasus operator conducting cross-border surveillance of dissidents, activists, and researchers using NSO Group’s Pegasus spyware, including the targeting and likely infection of Omar Abdulaziz in Canada.
Pegasus operator linked to Saudi Arabia that targeted journalist Ben Hubbard, Saudi dissidents, and an Amnesty International staff member using SMS messages with malicious links and Pegasus infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.