NSO Group
NSO Group is an Israeli private sector offensive actor and spyware vendor, also referred to as NSO and Q Cyber Technologies. Its signature spyware is Pegasus, also referred to in the content as Q Suite. Microsoft maps DEV-0336 to Night Tsunami and identifies it as NSO Group. The content describes NSO Group as a commercial provider of surveillance and hacking capabilities sold to government customers, and as an "access-as-a-service" provider selling packaged hacking solutions. Pegasus is described as spyware / a remote access trojan capable of infecting iOS, Android, and BlackBerry devices. Once installed, Pegasus can provide near-complete access to a target device, including passwords, contacts, calendar events, text messages, live voice calls, emails, photos, messages, browser history, screenshots, communications from apps such as iMessage, Skype, Telegram, WeChat, Facebook Messenger, and WhatsApp, as well as camera, microphone, GPS, and location data. The supporting content links NSO Group with multiple zero-click and zero-day delivery vectors. WhatsApp publicly attributed a 2019 campaign to NSO Group in which a vulnerability in WhatsApp audio-calling functionality, tracked as CVE-2019-3568, was used to target roughly 1,400 devices by placing crafted calls that could trigger spyware installation even if the call was not answered. Court filings cited in the content allege NSO Group and Q Cyber used WhatsApp infrastructure, reverse-engineered WhatsApp traffic, created WhatsApp accounts, and routed malicious code through signaling and relay servers to deliver Pegasus. Trial reporting in the content says NSO used a "WhatsApp Installation Server," follow-on infrastructure, and internally named WhatsApp vectors Eden, Heaven, and Erised, collectively Hummingbird, and that targeting via WhatsApp continued after the lawsuit was filed. The content also attributes iMessage-based Pegasus exploitation to NSO Group. Citizen Lab attributed the ForcedEntry exploit to NSO Group with high confidence; ForcedEntry exploited CVE-2021-30860 and was used as a zero-click iMessage chain against activists, including Bahraini and Saudi activists, while bypassing Apple BlastDoor protections. Separate Apple emergency updates addressed CVE-2023-41061 and CVE-2023-41064, which Citizen Lab reported were weaponized in the BLASTPASS zero-click iMessage exploit chain to deliver Pegasus against a Washington, D.C.-based civil society target. The content further references a previously undocumented "MMS Fingerprint" capability from NSO-related contract evidence, described as revealing device and OS version by sending an MMS without requiring user interaction; researchers reproduced automatic handset HTTP requests leaking UserAgent and x-wap-profile data that could help tailor Pegasus deployment. Targets explicitly mentioned in the content include journalists, human rights activists and defenders, lawyers, political dissidents, diplomats, government officials, senior foreign government officials, civil society members, activists, and other specific individuals across multiple countries. The content cites targeting in at least 20 countries and references victims in 51 countries in the 2019 WhatsApp campaign. It also references documented Pegasus targeting involving a Saudi activist, a Bahraini activist, Amnesty International staff, human rights defenders in Morocco and Bahrain, a close confidant of Jamal Khashoggi, and New York Times journalist Ben Hubbard. The content states NSO Group claims it sells only to government clients and that exports are conducted under Israeli export laws and oversight. At the same time, the content describes repeated allegations and findings of abuse by government customers against civil society. It notes WhatsApp sued NSO Group in 2019, Apple later sued NSO Group over Pegasus attacks on Apple users, the United States added NSO Group to the Entity List, and a California jury ordered NSO Group to pay Meta $167.25 million over the 2019 WhatsApp Pegasus campaign.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Non-Governmental Organizations
- Academia & Research
- Independent Media
- Military
- Health Care Equipment & Services
Where they target
Geographies tied to known operations.
- 🇪🇸 Spain
- 🇧🇪 Belgium
- 🇩🇪 Germany
- 🇨🇭 Switzerland
- 🇺🇸 United States
Tradecraft
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
Citizen Lab managed to capture an NSO iMessage-based zero-click exploit... The vulnerability discussed in this blog post was fixed on September 13, 2021 in iOS 14.8 as CVE-2021-30860.
On or about May 13, 2019, Facebook publicly announced that it had investigated and identified a vulnerability involving the WhatsApp Service (CVE-2019-3568). WhatsApp and Facebook closed the vulnerability, contacted law enforcement, and advised users to update the WhatsApp app.
On information and belief, in order to enable Pegasus’ remote installation, Defendants exploited vulnerabilities in operating systems and applications (e.g., CVE-2016-4657) and used other malware delivery methods, like spearphishing messages containing links to malicious code.
Apple ... released emergency security updates ... to address two zero-day flaws that have been exploited in the wild to deliver NSO Group's Pegasus ... CVE-2023-41061 - A validation issue in Wallet that could result in arbitrary code execution when handling a maliciously crafted attachment.
CVE-2023-41064 - A buffer overflow issue in the Image I/O component that could result in arbitrary code execution when processing a maliciously crafted image.
1 more CVE tied to this actor tracked in Mallory.
Observables
147 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial spyware operator/vendor associated in the content with Pegasus spyware attacks against users, including a WhatsApp-targeting campaign and an attack blocked by Apple Lockdown Mode.
Referenced as a prior example of a commercial spyware operator whose Pegasus toolchain has historically leveraged browser use-after-free (UAF) vulnerabilities (here, WebKit) as part of exploit chains.
Commercial/mercenary spyware vendor associated in the article with Pegasus deployments against high-risk individuals (e.g., journalists, activists, political figures) via WhatsApp and other messaging-app vectors, including use of zero-click and alleged zero-day exploits.
Commercial spyware vendor behind Pegasus; implicated in sophisticated spyware-enabled targeting of WhatsApp users, prompting platform hardening and ongoing litigation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.