Zero-Click Pegasus Spyware Hits Serbian University Rector and Prosecutor Weeks Before National Elections
Executive Summary
In 2026, NSO Group's Pegasus spyware was confirmed on devices belonging to Vladan Đokić, rector of the University of Belgrade and a figurehead of Serbia's student protest movement, and Rade Bajić, a prosecutor pursuing a high-profile corruption case linked to Serbian President Aleksandar Vučić. The infection leveraged a zero-click exploit requiring no user interaction, discovered through forensic analysis by the SHARE Foundation and confirmed by The Citizen Lab at the University of Toronto. The attacks occurred ahead of Serbia's October 25 parliamentary elections, targeting critics of the government at a politically sensitive moment and raising urgent questions about state-directed surveillance of civil society.
This incident is part of a documented pattern of commercial spyware abuse in Serbia, following a September wave that hit 14 individuals including parliamentarians and local officials. The targeting of legal professionals and university leaders signals an escalating use of Pegasus-class tools against democratic institutions, mirroring global trends where authoritarian governments deploy commercial surveillance against political opponents, journalists, and activists.
Why This Matters Now
With Serbia's parliamentary elections on October 25, 2026, the confirmed Pegasus infections of a university rector and a prosecutor represent a direct assault on democratic oversight. Commercial spyware vendors like NSO Group continue operating despite repeated abuse findings, and the zero-click delivery mechanism means no behavioral change by targets can prevent infection—making network-level telemetry and egress controls among the few viable detection layers.
Attack Path Analysis
NSO Group's Pegasus spyware was silently deployed against Serbian dissidents, journalists, and legal officials via a zero-click exploit requiring no user interaction, granting the operator immediate covert access to the target device. Once implanted, Pegasus established encrypted command-and-control channels, escalated to full device privileges, harvested sensitive communications and legal case files, and exfiltrated data to remote operator infrastructure — all while evading detection on personal mobile endpoints with no cloud network security controls in place to monitor or block the covert outbound traffic.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Pegasus was delivered via a zero-click exploit targeting iOS or Android devices belonging to Vladan Đokić and Rade Bajić. No user interaction was required — the exploit silently executed upon receipt of a crafted message or network-level injection, leveraging undisclosed zero-day vulnerabilities in the device OS or messaging stack. This technique bypasses all user-awareness controls and is consistent with NSO Group's KISMET and FORCEDENTRY exploit frameworks.
MITRE ATT&CK® Techniques
Application Layer Protocol: Web Protocols
Exploit Public-Facing Application
User Execution
Location Tracking
Stored Application Data
Input Injection
Software Discovery
Subvert Trust Controls: Code Signing Policy Modification
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
GDPR (EU General Data Protection Regulation) – Integrity, Confidentiality, and Security of Personal Data
Control ID: Article 5(1)(f) / Article 32
NIS2 Directive (EU Network and Information Security Directive 2) – Cybersecurity Risk Management Measures
Control ID: Article 21 – Security of Network and Information Systems
CISA Zero Trust Maturity Model 2.0 – Device Trustworthiness and Continuous Monitoring
Control ID: Device Pillar – Device Visibility and Analytics / Endpoint Security
ISO/IEC 27001:2022 – Vulnerability Management and ICT Resilience
Control ID: Annex A 8.8 – Management of Technical Vulnerabilities / Annex A 5.30 – ICT Readiness for Business Continuity
Council of Europe Convention 108+ (Modernised Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data) – Protection of Personal Data Against Unlawful Surveillance
Control ID: Article 7 – Data Security / Article 9 – Sanctions and Remedies
DORA (EU Digital Operational Resilience Act) – Advanced Threat Simulation and Incident Response Readiness
Control ID: Article 45 – Threat-Led Penetration Testing / Article 13 – ICT-Related Incident Management
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Pegasus zero-click spyware targeting Serbian officials and prosecutors signals critical risk to government devices, with exfiltration-weighted kill chain stages threatening sensitive administrative data before October elections.
Law Practice/Law Firms
Prosecution attorneys handling high-profile corruption cases face targeted commercial spyware infiltration, with NIST.800-53.SC-7 and egress security gaps enabling covert exfiltration of privileged legal communications and case evidence.
Higher Education/Acadamia
University leadership devices compromised via zero-click Pegasus infection, with physical server seizures compounding risk; zero trust segmentation and multicloud visibility controls critically absent in academic infrastructure environments.
Political Organization
Pre-election surveillance of opposition-linked activists and parliamentarians demonstrates spyware as a repression tool, exploiting unencrypted traffic and weak egress policy enforcement to exfiltrate politically sensitive communications at scale.
Sources
- Spyware found on devices belonging to prominent Serbian critics as elections loomhttps://cyberscoop.com/pegasus-spyware-serbia-critics-elections/Verified
- SHARE Foundation - Serbian Digital Rights Organization Research on Spyware Surveillancehttps://www.sharefoundation.info/Verified
- The Citizen Lab - NSO Group Pegasus Research and Trackinghttps://citizenlab.ca/category/research/nso-group-pegasus/Verified
- Amnesty International - NoviSpy Android Spyware Report (Serbia, 2024)https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-data-extraction-tools-to-target-journalists-and-activists/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NSO Group Pegasus - Apple Threat Notifications to Targeted Usershttps://support.apple.com/en-us/111900Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because Pegasus relied entirely on unmonitored outbound mobile device traffic and unconstrained access to cloud-connected organizational resources to complete its mission. By enforcing identity-aware segmentation and controlled egress paths across cloud workloads and services the targets accessed, CNSF would likely have reduced the attacker's ability to reach organizational systems and exfiltrate data without triggering policy violations.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level visibility into device-originating traffic destined for cloud workloads could likely surface anomalous connection patterns associated with the initial exploit delivery, reducing the attacker's ability to silently reach protected organizational resources immediately after device compromise.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation applied to cloud workloads and services the target device accessed would likely limit the blast radius of privilege escalation by ensuring that elevated device-level access does not automatically translate into broader permissions across cloud-hosted organizational systems.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement across cloud workload segments would likely constrain how far harvested credentials could be leveraged to move between organizational services, reducing the attacker's ability to pivot freely across cloud-hosted resources even when valid session tokens were in hand.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility spanning cloud egress paths could likely surface covert C2 beaconing patterns that deviate from baseline organizational traffic profiles, reducing the attacker's ability to sustain undetected long-term command-and-control communication through monitored cloud network boundaries.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement at cloud network boundaries would likely reduce the attacker's ability to reliably exfiltrate sensitive organizational data to unknown external destinations, constraining outbound data transfer paths to only those permitted by defined egress policies.
Had cloud-connected organizational resources been protected by Zero Trust segmentation and egress controls, the attacker's ability to harvest legally privileged case files and organizational credentials at scale would likely have been constrained, reducing the breadth of intelligence available to the operator and limiting the downstream impact on the corruption prosecution and civil society targets.
Impact at a Glance
Affected Business Functions
- Civil Society and Democratic Oversight Operations
- Legal Prosecution and Judicial Proceedings
- University Administration and Academic Governance
- Confidential Communications and Source Protection
Estimated downtime: N/A
Estimated loss: N/A
Highly sensitive personal and professional data was at risk across two confirmed targets. For Vladan Dokic (University of Belgrade Rector), potential exposure includes confidential communications with student protest organizers, university administrative records, strategic planning documents, and private correspondence related to his confrontations with Serbian government authorities. For Rade Bajic (Public Prosecutor's Office lawyer), potential exposure includes privileged legal case files, confidential witness information, prosecution strategies, and communications pertaining to a high-profile $500 million corruption case allegedly involving Serbian President Vucic and Affinity Partners. The zero-click nature of the Pegasus infection means full device access was achieved without user interaction, including microphone, camera, messages, emails, and stored documents. A third device (Bajic's) remains under active forensic investigation for an unidentified spyware strain. The broader Serbian surveillance campaign documented since 2024 has targeted at least 14 individuals including parliamentarians, journalists, activists, and civil society members, indicating systemic and ongoing data compromise at the intersection of political opposition and rule-of-law institutions.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Egress Security & Policy Enforcement (CNSF): Deploy FQDN-based egress filtering and outbound traffic policy enforcement on all networks used by high-risk individuals and organizations to detect and block covert Pegasus C2 beaconing to known or anomalous operator infrastructure — directly reducing exfiltration success even when endpoint compromise occurs.
- • Deploy Multicloud Visibility & Control for Anomaly Detection: Instrument network traffic observability across hybrid and mobile-adjacent environments to baseline normal outbound communication patterns; anomalous encrypted traffic bursts or unexpected HTTPS destinations from device-associated accounts should trigger automated alerts consistent with Pegasus C2 and exfiltration behaviors.
- • Apply Zero Trust Segmentation to Sensitive Workloads: Enforce least-privilege, identity-based access policies for legal case management systems, organizational servers, and cloud collaboration tools accessed by high-value targets — limiting the blast radius of device compromise by preventing lateral pivot from a compromised personal device to protected organizational resources.
- • Implement Encrypted Traffic (HPE) Inspection Frameworks: While Pegasus encrypts its own C2 traffic, deploying high-performance encryption controls on organizational network perimeters combined with metadata-level traffic analysis (connection timing, destination reputation, volume anomalies) can surface behavioral indicators of spyware exfiltration without requiring plaintext inspection.
- • Activate Inline IPS (Suricata) with Mobile Threat Signatures: Deploy inline intrusion prevention with updated Pegasus and commercial spyware threat signatures at organizational network egress points and VPN gateways used by at-risk personnel; while zero-click exploits may bypass endpoint detection, known Pegasus infrastructure IOCs and traffic signatures can be matched at the network layer to trigger incident response workflows.
