Pegasus

Overview

Pegasus is the most invasive, sophisticated, and technologically formidable commercial mobile spyware platform in contemporary cybersecurity, developed and licensed exclusively to government intelligence and law enforcement agencies by the Israeli surveillance firm NSO Group. Uncovered initially by Citizen Lab and Lookout in August 2016 and subject to worldwide investigative scrutiny in July 2021 by the Pegasus Project consortium, Pegasus is designed to achieve silent, complete remote compromise of Apple iOS and Google Android mobile devices. Pegasus pioneered zero-click remote exploitation: rather than requiring targeted victims to click on malicious phishing links, Pegasus leverages zero-click exploit chains delivered through incoming iMessage, WhatsApp, or Apple HomeKit network streams that execute in the background without triggering any notification or ringtone. Its most famous exploit chain, 'FORCEDENTRY' (uncovered by Citizen Lab and patched under CVE-2021-30860), weaponized an integer overflow in Apple's CoreGraphics/ImageIO library when parsing malformed JBIG2 stream objects disguised inside fake PDF attachments, emulating logic gates in memory to break out of the iOS sandbox and attain complete kernel-level control. Once deployed, Pegasus grants operators total surveillance access: it silently activates the handset's microphone and camera for real-time ambient recording, extracts end-to-end encrypted messaging logs (Signal, WhatsApp, Telegram), harvests emails, photos, contact lists, and calendar records, and tracks GPS location continuously.

Known aliases

Threat reports may refer to this family under multiple names:

• Pegasus Spyware
• NSO Group Pegasus
• Chrysaor (Android variant)
• FORCEDENTRY Spyware

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Nso_Surveillance_Framework

Known Derivatives & Downstream Variants: Pegasus_Ios · Chrysaor_Android · Forcedentry_Chain

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1203 · T1404 · T1636 · T1418 · T1432 · T1430 · T1412

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2021-30860 — Vulnerability documentation and metrics (NIST NVD ↗).

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8
• 28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520

Delivery vectors

• Zero-click iMessage exploitation weaponizing JBIG2 PDF parsing vulnerability CVE-2021-30860 (FORCEDENTRY)
• One-click SMS and WhatsApp phishing messages containing spoofed delivery or tracking links
• Over-the-air interception via tactical cellular rogue base stations (IMSI catchers)

Persistence mechanisms

• Ephemeral memory residency operating in root daemons without persistent disk modification
• Injection into core system processes (imagent, SpringBoard, mediaserverd)
• Automated self-destruction mechanism if detection or analysis sandbox is detected

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PEGASUS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pegasus"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "pegasus" ascii wide nocase
        $s2 = "pegasus spyware" ascii wide nocase
        $s3 = "nso group pegasus" ascii wide nocase
        $s4 = "chrysaor (android variant)" ascii wide nocase
        $s5 = "forcedentry spyware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Pegasus (Spyware) Execution & Triage
id: 6bd49481-be49-5840-b1d7-ca8869b159c7
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Pegasus malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/pegasus
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.spyware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1203
- attack.t1404
- attack.t1636
- attack.t1418
- attack.t1432
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_PEGASUS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pegasus tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "pegasus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

References & External Analysis

• The Citizen Lab: FORCEDENTRY - NSO Group Zero-Click Apple Exploit Captured in the Wild
• Amnesty International: Forensic Methodology Report - How to Catch NSO Group's Pegasus
• Apple Security Advisory HT212807: iOS 14.8 Security Update
• Search "pegasus" on VirusTotal (External Analysis)
• Search "pegasus" on Any.Run (Sandbox Sandbox)
• Search "pegasus" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Spyware)

Explore other documented threats in the same operational category:

• Freekeylogger
• Qqlogger
• Predator
• Webwatcher
• Fearless_Key_Spy
• Relevantknowledge
• Fearless_Lite
• Hookey

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/pegasus.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.