Citizen Lab Finds Pegasus Infections on Former MEP Stelios Kouloglou’s iPhone
Summary
Citizen Lab says forensic analysis found Pegasus infections on former MEP Stelios Kouloglou’s iPhone in October 2022 and March 2023, while he served on the European Parliament’s spyware inquiry committee. The operator remains unidentified.
Key points
- Citizen Lab says forensic analysis found Pegasus infections on Kouloglou’s iPhone on or around October 21, 2022, and March 6–7, 2023.
- Researchers assess that the infections used the zero-click PWNYOURHOME exploit; the iPhone was running iOS 15.5 at the time, and Apple addressed the issue in iOS 16.3.1.
- The infections occurred while Kouloglou served on the European Parliament’s PEGA Committee, which investigated the use of commercial spyware.
- A HomeKit email address found in the first infection also appeared in a campaign targeting Russian- and Belarusian-speaking exiled journalists and activists, but researchers could not identify the operator or attribute the infections to a government.
- Kouloglou received Apple threat notifications about mercenary spyware targeting on three occasions between March 2023 and April 2024.
- The article also summarizes separate Citizen Lab findings that Russian authorities used Cellebrite UFED to search activist Andrey Pivovarov’s devices in 2021.
- Separate research described telecom-based location-tracking campaigns abusing SMS commands and SS7 or Diameter signaling weaknesses, without requiring malware on targets’ devices.
Article Details
- Victim Organization
- European Parliament (targeted member: Stelios Kouloglou)
- Incident Type
- Pegasus spyware infection of a personal iPhone
- Incident Date
- 2022-10-21
- Data Types Exposed
- Confidential documents (potentially accessible; access not confirmed)
- Committee deliberations (potentially accessible; access not confirmed)
- Operational Impact
- Citizen Lab forensic analysis found Pegasus infections on Kouloglou's iPhone on or around 2022-10-21 and again on 2023-03-06 and 2023-03-07. Researchers said attackers could have accessed confidential documents and committee deliberations, but the article does not confirm that they did.
- Claim Status
- confirmed
People
Anastasiya BurakovaThe article says she was later targeted in a phishing campaign attributed to COLDRIVER.Andrey PivovarovDetained opposition activist whose iPhone the article says Russian authorities accessed using Cellebrite UFED.Bahr Abdul RazzakCitizen Lab researcher credited with the forensic findings on Kouloglou's Pegasus infections.Bill MarczakCitizen Lab researcher credited with the forensic findings on Kouloglou's Pegasus infections.John Scott-RailtonCitizen Lab researcher credited with the forensic findings on Kouloglou's Pegasus infections.Kate PundykCitizen Lab researcher credited with the forensic findings on Kouloglou's Pegasus infections.Ron DeibertCitizen Lab researcher credited with the forensic findings on Kouloglou's Pegasus infections.Siena AnstisCitizen Lab researcher credited with the forensic findings on Kouloglou's Pegasus infections.Stelios KouloglouFormer MEP whose iPhone Citizen Lab found infected with Pegasus in 2022 and 2023.Thanasis KoukakisGreek investigative journalist whose phone the article says was compromised with Intellexa's Predator spyware; he also testified before the PEGA Committee.
Threat Actors
Malware
PegasusCitizen Lab found that former MEP Stelios Kouloglou was repeatedly infected with Pegasus spyware while serving on the PEGA Committee investigating commercial surveillance abuses in the European Union.Predatorby Greek investigative journalist Thanasis Koukakis, who had his own phone compromised with Intellexa’s Predator spyware and had testified before the PEGA Committee a month before.
Vendors
019MobileThe two campaigns are said to have abused three specific telecom providers, namely 019Mobile, Airtel Jersey (part of Sure Group), and Tango Networks U.K., that act as “surveillance entry and transit points within theAirtel JerseyThe two campaigns are said to have abused three specific telecom providers, namely 019Mobile, Airtel Jersey (part of Sure Group), and Tango Networks U.K., that act as “surveillance entry and transit points within theAppleIt’s assessed that a zero-click exploit in Apple’s smart home software, codenamed PWNYOURHOME, was used to deliver the spyware.Cellebriteand Belarusian-speaking exiled journalists and activists, while separately highlighting abuse of Cellebrite UFED, COLDRIVER, and telecom infrastructure by surveillance operators.Intellexavisited by Greek investigative journalist Thanasis Koukakis, who had his own phone compromised with Intellexa’s Predator spyware and had testified before the PEGA Committee a month before.NSO Group“Based on what we know of NSO Group’s licensing, this would likely indicate that the customer had a license that enabled infections in multiple E.U.Sure Groupare said to have abused three specific telecom providers, namely 019Mobile, Airtel Jersey (part of Sure Group), and Tango Networks U.K., that act as “surveillance entry and transit points within theTango Networksabused three specific telecom providers, namely 019Mobile, Airtel Jersey (part of Sure Group), and Tango Networks U.K., that act as “surveillance entry and transit points within the telecommunications ecosystem” and
Products
Tools
Countries
Industries
GovernmentThe infections have not been attributed to a particular government at this time, and there is no evidence that the Greek government is behind the activity.TelecommunicationsSure Group), and Tango Networks U.K., that act as “surveillance entry and transit points within the telecommunications ecosystem” and “allow traffic to move through trusted signalling interconnections while granting