{
	"id": "a7ce2c52-6848-45f0-a841-300536e9da95",
	"created_at": "2026-04-06T00:15:18.319132Z",
	"updated_at": "2026-04-10T03:35:29.039368Z",
	"deleted_at": null,
	"sha1_hash": "4ce751d63b085832c4b0b189bf9e38c36e4d6e75",
	"title": "Massive data leak reveals Israeli NSO Group’s spyware used to target activists, journalists, and political leaders globally",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 62503,
	"plain_text": "Massive data leak reveals Israeli NSO Group’s spyware used to\r\ntarget activists, journalists, and political leaders globally\r\nPublished: 2021-07-18 · Archived: 2026-04-05 22:07:49 UTC\r\nNSO Group’s spyware has been used to facilitate human rights violations around the world on a massive scale,\r\naccording to a major investigation into the leak of 50,000 phone numbers of potential surveillance targets. These\r\ninclude heads of state, activists and journalists, including Jamal Khashoggi’s family.\r\nThe Pegasus Project lays bare how NSO’s spyware is a weapon of choice for repressive governments\r\nseeking to silence journalists, attack activists and crush dissent, placing countless lives in peril.\r\nAgnès Callamard, Secretary General of Amnesty International.\r\nThe Pegasus Project is a ground-breaking collaboration by more than 80 journalists from 17 media organizations\r\nin 10 countries coordinated by Forbidden Stories, a Paris-based media non-profit, with the technical support of\r\nAmnesty International, who conducted cutting- edge forensic tests on mobile phones to identify traces of the\r\nspyware.\r\n“The Pegasus Project lays bare how NSO’s spyware is a weapon of choice for repressive governments seeking to\r\nsilence journalists, attack activists and crush dissent, placing countless lives in peril,” said Agnès Callamard,\r\nSecretary General of Amnesty International.\r\n“These revelations blow apart any claims by NSO that such attacks are rare and down to rogue use of their\r\ntechnology. While the company claims its spyware is only used for legitimate criminal and terror investigations,\r\nit’s clear its technology facilitates systemic abuse. They paint a picture of legitimacy, while profiting from\r\nwidespread human rights violations.”\r\n“Clearly, their actions pose larger questions about the wholesale lack of regulation that has created a wild west of\r\nrampant abusive targeting of activists and journalists. Until this company and the industry as a whole can show it\r\nis capable of respecting human rights, there must be an immediate moratorium on the export, sale, transfer and use\r\nof surveillance technology.”\r\nIn a written response to Forbidden Stories and its media partners, NSO Group said it “firmly denies… false\r\nclaims” in the report. It wrote that the consortium’s reporting was based on “wrong assumptions” and\r\n“uncorroborated theories” and reiterated that the company was on a “life-saving mission”. A fuller summary of\r\nNSO Group’s response is available here.\r\nThe Investigation\r\nAt the centre of this investigation is NSO Group’s Pegasus spyware which, when surreptitiously installed on\r\nvictims’ phones, allows an attacker complete access to the device’s messages, emails, media, microphone, camera,\r\ncalls and contacts.\r\nhttps://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/\r\nPage 1 of 4\n\nOver the next week, media partners of The Pegasus Project – including The Guardian, Le Monde, Süddeutsche\r\nZeitung and The Washington Post – will run a series of stories exposing details of how world leaders, politicians,\r\nhuman rights activists, and journalists have been selected as potential targets of this spyware.\r\nFrom the leaked data and their investigations, Forbidden Stories and its media partners identified potential NSO\r\nclients in 11 countries: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi\r\nArabia, Togo, and the United Arab Emirates (UAE).\r\nNSO Group has not taken adequate action to stop the use of its tools for unlawful targeted surveillance of activists\r\nand journalists, despite the fact that it either knew, or arguably ought to have known, that this was taking place.\r\nThe Pegasus Project revelations must act as a catalyst for change. The surveillance industry must no\r\nlonger be afforded a laissez-faire approach from governments with a vested interest in using this\r\ntechnology to commit human rights violations.\r\nAgnès Callamard, Secretary General of Amnesty International\r\n“As a first step, NSO Group must immediately shut down clients’ systems where there is credible evidence of\r\nmisuse. The Pegasus Project provides this in abundance,” said Agnès Callamard.\r\nKhashoggi family targeted \r\nDuring the investigation, evidence has also emerged that family members of Saudi journalist Jamal Khashoggi\r\nwere targeted with Pegasus software before and after his murder in Istanbul on 2 October 2018 by Saudi\r\noperatives, despite repeated denials from NSO Group.\r\nAmnesty International’s Security Lab established that Pegasus spyware was successfully installed on the phone of\r\nKhashoggi’s fiancée Hatice Cengiz just four days after his murder.\r\nHis wife, Hanan Elatr was also repeatedly targeted with the spyware between September 2017 and April 2018 as\r\nwell as his son, Abdullah, who was also selected as a target along with other family members in Saudi Arabia and\r\nthe UAE.\r\nIn a statement, the NSO Group responded to the Pegasus Project allegations saying that its “technology was not\r\nassociated in any way with the heinous murder of Jamal Khashoggi”. The company said that it “previously\r\ninvestigated this claim, immediately after the heinous murder, which again, is being made without validation”.\r\nJournalists under attack\r\nThe investigation has so far identified at least 180 journalists in 20 countries who were selected for potential\r\ntargeting with NSO spyware between 2016 to June 2021, including in Azerbaijan, Hungary, India and Morocco,\r\ncountries where crackdowns against independent media have intensified.\r\nThe revelations show the real-world harm caused by unlawful surveillance:\r\nIn Mexico, journalist Cecilio Pineda’s phone was selected for targeting just weeks before his killing in\r\n2017. The Pegasus Project identified at least 25 Mexican journalists were selected for targeting over a two-https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/\r\nPage 2 of 4\n\nyear period. NSO has denied that even if Pineda’s phone had been targeted, data collected from his phone\r\ncontributed to his death.\r\nPegasus has been used in Azerbaijan, a country where only a few independent media outlets remain. More\r\nthan 40 Azerbaijani journalists were selected as potential targets according to the investigation. Amnesty\r\nInternational’s Security Lab found the phone of Sevinc Vaqifqizi, a freelance journalist for independent\r\nmedia outlet Meydan TV, was infected over a two-year period until May 2021.\r\nIn India, at least 40 journalists from nearly every major media outlet in the country were selected as\r\npotential targets between 2017-2021. Forensic tests revealed the phones of Siddharth Varadarajan and MK\r\nVenu, co-founders of independent online outlet The Wire, were infected with Pegasus spyware as recently\r\nas June 2021.\r\nThe investigation also identified journalists working for major international media including the Associated\r\nPress, CNN, The New York Times and Reuters as potential targets. One of the highest profile journalists\r\nwas Roula Khalaf, the editor of the Financial Times.\r\n“The number of journalists identified as targets vividly illustrates how Pegasus is used as a tool to intimidate\r\ncritical media. It is about controlling public narrative, resisting scrutiny, and suppressing any dissenting voice,”\r\nsaid Agnès Callamard.\r\n“These revelations must act as a catalyst for change. The surveillance industry must no longer be afforded a\r\nlaissez-faire approach from governments with a vested interest in using this technology to commit human rights\r\nviolations.”\r\nExposing Pegasus infrastructure\r\nAmnesty International is today releasing the full technical details of its Security Lab’s in-depth forensic\r\ninvestigations as part of the Pegasus Project.\r\nThe Lab’s methodology report documents the evolution of Pegasus spyware attacks since 2018, with details on the\r\nspyware’s infrastructure, including more than 700 Pegasus-related domains.\r\n“NSO claims its spyware is undetectable and only used for legitimate criminal investigations. We have now\r\nprovided irrefutable evidence of this ludicrous falsehood,” said Etienne Maynier, a technologist at Amnesty\r\nInternational’s Security Lab.\r\nThere is nothing to suggest that NSO’s customers did not also use Pegasus in terrorism and crime investigations,\r\nand the Forbidden Stories consortium also found numbers in the data belonging to suspected criminals.\r\n“The widespread violations Pegasus facilitates must stop. Our hope is the damning evidence published over the\r\nnext week will lead governments to overhaul a surveillance industry that is out of control,” said Etienne Maynier.\r\nIn response to a request for comment by media organizations involved in the Pegasus Project, NSO Group said it\r\n“firmly denies” the claims and stated that “many of them are uncorroborated theories which raise serious doubts\r\nabout the reliability of your sources, as well as the basis of your story.” NSO Group did not confirm or deny which\r\ngovernments are NSO Group’s customers, although it said that the Pegasus Project had made “incorrect\r\nassumptions” in this regard.  Notwithstanding its general denial of the claims, NSO Group said it “will continue to\r\ninvestigate all credible claims of misuse and take appropriate action based on the results of these investigations”.\r\nhttps://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/\r\nPage 3 of 4\n\nSource: https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/\r\nhttps://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/"
	],
	"report_names": [
		"the-pegasus-project"
	],
	"threat_actors": [
		{
			"id": "42a6a29d-6b98-4fd6-a742-a45a0306c7b0",
			"created_at": "2022-10-25T15:50:23.710403Z",
			"updated_at": "2026-04-10T02:00:05.281246Z",
			"deleted_at": null,
			"main_name": "Silence",
			"aliases": [
				"Whisper Spider"
			],
			"source_name": "MITRE:Silence",
			"tools": [
				"Winexe",
				"SDelete"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "eb5915d6-49a0-464d-9e4e-e1e2d3d31bc7",
			"created_at": "2025-03-29T02:05:20.764715Z",
			"updated_at": "2026-04-10T02:00:03.851829Z",
			"deleted_at": null,
			"main_name": "GOLD WYMAN",
			"aliases": [
				"Silence "
			],
			"source_name": "Secureworks:GOLD WYMAN",
			"tools": [
				"Silence"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "88e53203-891a-46f8-9ced-81d874a271c4",
			"created_at": "2022-10-25T16:07:24.191982Z",
			"updated_at": "2026-04-10T02:00:04.895327Z",
			"deleted_at": null,
			"main_name": "Silence",
			"aliases": [
				"ATK 86",
				"Contract Crew",
				"G0091",
				"TAG-CR8",
				"TEMP.TruthTeller",
				"Whisper Spider"
			],
			"source_name": "ETDA:Silence",
			"tools": [
				"EDA",
				"EmpireDNSAgent",
				"Farse",
				"Ivoke",
				"Kikothac",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Meterpreter",
				"ProxyBot",
				"ReconModule",
				"Silence.Downloader",
				"TiniMet",
				"TinyMet",
				"TrueBot",
				"xfs-disp.exe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434518,
	"ts_updated_at": 1775792129,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4ce751d63b085832c4b0b189bf9e38c36e4d6e75.pdf",
		"text": "https://archive.orkl.eu/4ce751d63b085832c4b0b189bf9e38c36e4d6e75.txt",
		"img": "https://archive.orkl.eu/4ce751d63b085832c4b0b189bf9e38c36e4d6e75.jpg"
	}
}