NSO Pegasus Technical Intelligence Dossier

Executive Summary & Threat Architecture

Pegasus is the most invasive, sophisticated, and technologically formidable commercial mobile spyware platform in contemporary cybersecurity, developed and licensed exclusively to government intelligence and law enforcement agencies by the Israeli surveillance firm NSO Group. Uncovered initially by Citizen Lab and Lookout in August 2016 and subject to worldwide investigative scrutiny in July 2021 by the Pegasus Project consortium, Pegasus is designed to achieve silent, complete remote compromise of Apple iOS and Google Android mobile devices. Pegasus pioneered zero-click remote exploitation: rather than requiring targeted victims to click on malicious phishing links, Pegasus leverages zero-click exploit chains delivered through incoming iMessage, WhatsApp, or Apple HomeKit network streams that execute in the background without triggering any notification or ringtone. Its most famous exploit chain, 'FORCEDENTRY' (uncovered by Citizen Lab and patched under CVE-2021-30860), weaponized an integer overflow in Apple's CoreGraphics/ImageIO library when parsing malformed JBIG2 stream objects disguised inside fake PDF attachments, emulating logic gates in memory to break out of the iOS sandbox and attain complete kernel-level control. Once deployed, Pegasus grants operators total surveillance access: it silently activates the handset's microphone and camera for real-time ambient recording, extracts end-to-end encrypted messaging logs (Signal, WhatsApp, Telegram), harvests emails, photos, contact lists, and calendar records, and tracks GPS location continuously.

Observed Threat Aliases: Pegasus Spyware, NSO Group Pegasus, Chrysaor (Android variant), FORCEDENTRY Spyware

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: nso_surveillance_framework

Documented Downstream Variants: pegasus_ios, chrysaor_android, forcedentry_chain

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by NSO Pegasus operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Zero-click iMessage exploitation weaponizing JBIG2 PDF parsing vulnerability CVE-2021-30860 (FORCEDENTRY)
• One-click SMS and WhatsApp phishing messages containing spoofed delivery or tracking links
• Over-the-air interception via tactical cellular rogue base stations (IMSI catchers)

Host Persistence & Execution Hooks

• Ephemeral memory residency operating in root daemons without persistent disk modification
• Injection into core system processes (imagent, SpringBoard, mediaserverd)
• Automated self-destruction mechanism if detection or analysis sandbox is detected

Reference File Hashes (SHA-256)

• 7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8
• 28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520