Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, Citizen Lab confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and prominent pro-democracy figure, was infected with NSO Group's Pegasus spyware via a zero-click exploit — requiring no user interaction whatsoever. The disclosure came just six days before Serbia's October 25 snap parliamentary election. A second case involved Rade Bajić, a senior prosecutor investigating a Kushner-linked Belgrade property scandal, who received Apple Threat Notifications in August 2026. These findings extend a documented wave of at least 16 civil-society targets in Serbia in 2026 alone, including student activists and opposition politicians, with earlier cases also involving the Android spyware NoviSpy linked to Serbia's civilian intelligence agency BIA.

This incident reflects a sharp escalation in mercenary spyware deployment against democratic institutions and civil society ahead of contested elections. The pattern — zero-click exploits on fully updated devices, targeting lawyers, academics, and prosecutors — demonstrates that no device is inherently safe, and that network-level visibility and egress controls remain critical detection layers even when endpoint defenses are bypassed.

Why This Matters Now

Mercenary spyware like Pegasus increasingly targets civil society, legal professionals, and academics ahead of elections, exploiting zero-click vulnerabilities that bypass all user-facing defenses. With Apple issuing threat notifications across 110 countries in 2026 and at least 16 Serbian targets confirmed, organizations must assume mobile endpoints are compromised and prioritize network-level telemetry, encrypted traffic inspection, and anomaly-based egress controls to detect covert command-and-control and data exfiltration activity.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attack used a zero-click exploit, a technique that silently compromises a device by exploiting vulnerabilities in background processes such as iMessage or push notifications, requiring no tap, click, or file opening by the target. Citizen Lab confirmed the infection through forensic analysis of artifacts on Đokić's device.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is relevant here because the Pegasus operation depended on unrestricted outbound encrypted channels and uncontrolled lateral access to connected organizational systems from a compromised mobile endpoint. While the initial device compromise occurred outside cloud infrastructure, CNSF segmentation and egress controls could meaningfully reduce the blast radius by limiting which downstream cloud workloads and data paths the implant could reach.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF fabric-wide policy enforcement could limit the reachability of a compromised mobile endpoint to cloud-hosted workloads and internal services, reducing the scope of what an implant can access immediately after device compromise.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation could limit how far elevated device-level privileges translate into access across cloud workloads, constraining the implant's ability to move from the device into segmented cloud environments even after full kernel compromise.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls could reduce the reachability between cloud workloads or internal systems even if the attacker attempted to leverage harvested credentials or session tokens from the compromised device, limiting how far stolen identities could be used to traverse internal segments.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility tooling could surface anomalous outbound encrypted traffic patterns from managed endpoints or cloud-connected systems, making covert C2 communications more likely to be detected and helping constrain the duration of undetected operator access.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policy enforcement could constrain outbound data flows from cloud-connected systems or managed network paths, reducing the volume of sensitive data that an implant may successfully transmit to operator-controlled external infrastructure.

Impact (Mitigations)

Even with device-level compromise achieved, prior stage controls could have reduced the attacker's reach into organizational cloud systems, meaning the scope of exposed institutional data and associated contacts would likely have been narrower and the downstream impact on connected entities more contained.

Impact at a Glance

Affected Business Functions

  • Academic Leadership and University Administration
  • Civil Society Advocacy and Pro-Democracy Protest Coordination
  • Criminal Investigation and Public Prosecution (Anti-Corruption)
  • Personal Communications and Encrypted Messaging Privacy
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Pegasus spyware grants operators complete access equivalent to the device owner, including: private and encrypted messages (SMS, WhatsApp, Signal, iMessage), emails, contacts, call logs, calendar data, photos, documents, real-time GPS location tracking, and covert activation of the microphone and camera. For Vladan Dokic, this encompasses all university administrative communications, protest movement coordination, and personal correspondence. For Rade Bajic, the exposure likely includes sensitive prosecutorial materials related to the Generalstab corruption investigation into Kushner-linked property development, witness information, case strategy, and internal prosecutorial communications. The breadth of access constitutes a critical intelligence compromise affecting both individuals and their extended networks of contacts, colleagues, and family members.

Recommended Actions

  • • Enforce Egress Security & Policy Enforcement (CNSF): Deploy FQDN-based egress filtering and outbound traffic policy enforcement on all managed network paths to detect and block unauthorized data exfiltration to unknown or rotating Pegasus C2 infrastructure, aligning with NIST.800-53.SC-18 and ZTMM.Data controls.
  • • Deploy Multicloud Visibility & Control for Anomaly Detection: Implement centralized traffic observability and behavioral baselining across all network egress points to identify anomalous encrypted outbound flows consistent with spyware C2 beaconing, satisfying NIST.800-53.AU-6 and ZTMM.CrossCutting.Visibility requirements.
  • • Apply Encrypted Traffic (HPE) Controls on Sensitive Circuits: For organizational infrastructure and communications connecting high-risk individuals, enforce MACsec or IPsec line-rate encryption on all private circuits to prevent interception of data in transit, addressing NIST.CSF.PR.DS-2 and HIPAA.164.312(e)(1) obligations.
  • • Implement Zero Trust Segmentation for Privileged Workloads: Apply identity-based microsegmentation and least-privilege access policies to prevent compromised endpoint credentials harvested by spyware from enabling lateral movement into organizational systems, in accordance with NIST.800-53.AC-6 and ZTMM.Network controls.
  • • Activate Cloud Firewall (ACF) with AI-Driven Traffic Discovery: Deploy cloud-native egress firewall controls with AI-assisted discovery of outbound traffic patterns to identify and block communications to Pegasus-associated infrastructure before exfiltration occurs, supporting NIST.800-53.SC-7 and NIST.CSF.DE.CM-8 compliance postures.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image