StormWarning! Blog

The secret world of Pegasus Spyware or how governments are using stealthy surveillance to monitor a wide range of activities on the target device, including calls, messages, emails, and other forms of communication.

Ever heard about Pegasus?

Pegasus spy software is a sophisticated and powerful surveillance tool developed by the Israeli cybersecurity firm NSO Group. The software is capable of infecting and gaining full access to a user’s mobile phone, allowing the operator to monitor all of the phone’s activities including calls, messages, emails, social media, and even GPS location.

The software is primarily marketed to governments and law enforcement agencies as a tool for fighting terrorism and crime. However, recent revelations suggest that the software has been used for nefarious purposes, such as targeting journalists, activists, and politicians.

The Pegasus spyware works by exploiting vulnerabilities in a mobile phone’s operating system, allowing the operator to remotely install the software without the user’s knowledge or consent. Once installed, the software runs silently in the background, collecting and transmitting data to the operator’s server.

The NSO Group claims that the software is designed to target only specific individuals who are deemed to be a threat to national security or public safety. However, recent reports suggest that the software has been used to target a much broader range of individuals, including human rights activists, lawyers, and opposition politicians.

In July 2021, a consortium of international media outlets published a series of reports based on leaked data that revealed the extent of the Pegasus spyware’s misuse. According to the reports, the software has been used by governments in eleven countries so far , including Saudi Arabia, India, Mexico, Morocco, Togo, Rwanda, and Kazakhstan, to target journalists, activists, and opposition politicians.

The list of countries that use Pegasus surveillance comes from a collaborative investigation by a group of media outlets called the Pegasus Project, which was coordinated by Forbidden Stories, a nonprofit journalism organization based in Paris, and Amnesty International, a human rights organization. The investigation was based on leaked data containing more than 50,000 phone numbers that were allegedly targeted by Pegasus between 2016 and 2021. The list of countries was compiled based on the analysis of this data, as well as interviews with sources and other evidence. It’s important to note that some countries not on this list may also be using Pegasus, and that the NSO Group denies any wrongdoing in the sale of its software.

The exact number of presidents and premiers targeted by Pegasus spyware is not publicly known as the full list of individuals targeted has not been released. However, media reports from the Pegasus Project investigation and other sources have identified a number of presidents and heads of state who were allegedly targeted, including Emmanuel Macron of France, Cyril Ramaphosa of South Africa, Barham Salih of Iraq, and Sheikh Mohammed bin Rashed Al Maktoum of the UAE. It’s worth noting that the use of Pegasus for surveillance purposes is controversial and has been criticized for violating the privacy of individuals and potentially undermining democratic institutions.

The reports also revealed that the software has been used to target the family members and associates of journalists and activists, as well as lawyers and doctors who are in contact with these individuals. This has raised serious concerns about the safety and privacy of journalists and other individuals who are critical of their governments.

The revelations have also led to calls for stricter regulation of the spyware industry. In response, NSO Group has defended its product, stating that it is used exclusively by law enforcement agencies and that it is subject to rigorous oversight and regulation. The exact process of delivering Pegasus to government clients is not publicly known, as the NSO Group does not disclose its customers or their operational activities. However, it’s believed that the software is delivered to clients via a remote server, and the installation of the spyware on target devices is typically carried out by government agents or other operatives with physical access to the device.

However, critics argue that the company’s claims of oversight and regulation are questionable, and that the company’s software is being misused to violate the human rights of individuals around the world.

In summary, the Pegasus spyware represents a significant threat to privacy and human rights. While it may have legitimate uses in the fight against terrorism and crime, its potential for misuse is significant. As such, there is an urgent need for greater transparency and regulation of the spyware industry to ensure that these tools are not misused to violate the rights of individuals.

Guarding again Pegasus surveillance

The installation of Pegasus on a target device typically requires exploiting vulnerabilities in the device’s operating system or apps. For example, the spyware may be installed by sending a specially crafted message or link to the target, which, if clicked, will allow the spyware to be installed on the device without the user’s knowledge.

Guarding against Pegasus surveillance is a complex and challenging task, given the sophistication and stealthy nature of the spyware. However, there are several steps that individuals and organisations can take to reduce the risk of being targeted by the spyware:

Keep your device up to date: One of the primary ways that Pegasus spyware infects a device is by exploiting vulnerabilities in the operating system. Keeping your device’s software up to date can help prevent these vulnerabilities from being exploited.

Be cautious of suspicious messages: Pegasus spyware is often delivered through phishing messages, which are designed to trick the recipient into clicking on a link or downloading an attachment. Be cautious of messages from unknown senders or messages that contain suspicious links or attachments.

Use two-factor authentication: Two-factor authentication adds an additional layer of security to your accounts, making it more difficult for hackers to gain access to your data.

Use encrypted messaging apps: Encrypted messaging apps, such as Signal or WhatsApp, can help protect your messages and calls from being intercepted by spyware.

Disable unnecessary features: Disabling unnecessary features on your device, such as Bluetooth or Wi-Fi, can help reduce the attack surface for spyware.

Use anti-malware software: Anti-malware software can help detect and remove spyware from your device. Make sure to keep your anti-malware software up to date.

Be aware of your surroundings: Pegasus spyware can be used to remotely activate your device’s microphone and camera, allowing the operator to record audio and video. Be aware of your surroundings and be cautious when using your device in public places.

Seek legal and technical assistance: If you suspect that you have been targeted by Pegasus spyware, seek legal and technical assistance from experts in the field. They can help you identify and remove the spyware from your device and take steps to protect your privacy.

How do I know if my phone is infected with Pegasus? If you want to know if Pegasus is on your Android phone, you will have to use the official detection tool from Amnesty International. This tool is designed for forensics experts and only available for Linux and macOS. There’s no graphical user interface, so you’ll need to use the command line.

Once installed, Pegasus is designed to be difficult to detect, as it can hide its presence and activities from the user. It can also continue to operate even if the target device is updated or reset, as it is designed to be persistent and to remain hidden on the device.