{"id":"EUR-001","notes":"Coded Sep 25 2026. New pattern: transnational repression in exile — people are safe on EU soil but their phones are not. Country recorded as 'Europe (transnational)' (victims in Latvia, Lithuania, Poland; Timchenko infected in Germany). Pavlov and one Lithuanian person: targeted only.","country":"Europe (transnational)","sources":[{"url":"https://www.accessnow.org/press-release/exiled-russian-media-pegasus/","citation":"https://www.accessnow.org/press-release/exiled-russian-media-pegasus/"},{"url":"https://citizenlab.ca/research/pegasus-russian-belarusian-speaking-opposition-media-europe/","citation":"https://citizenlab.ca/research/pegasus-russian-belarusian-speaking-opposition-media-europe/"},{"url":"https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/","citation":"https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/"},{"url":"https://rsf.org/en/rsf-demands-thorough-investigation-after-pegasus-was-used-spy-prominent-exiled-russian-journalist","citation":"https://rsf.org/en/rsf-demands-thorough-investigation-after-pegasus-was-used-spy-prominent-exiled-russian-journalist"}],"summary":"Access Now and Citizen Lab found that exiled Russian- and Belarusian-speaking journalists and activists based in Latvia, Lithuania and Poland were targeted and, in most cases, infected with NSO Group's Pegasus between August 2020 and January 2023. Meduza's Galina Timchenko was infected around 10 February 2023 while in Berlin (first documented Pegasus use against exiled Russian media, published September 2023). Forensic artefacts suggest, without proving, that at least five cases came from a single NSO customer; no operator has been attributed, and neither Russia nor Belarus is a known Pegasus customer.","tactics":[{"code":"TC-21","role":"primary","label":"Surveillance Infrastructure / Spyware Deployment","needs_review":false},{"code":"TC-51","role":"secondary","label":"Direct Intimidation of Journalists and Civic Actors","needs_review":false}],"version":1,"channels":["Covert spyware infection (Pegasus) of exiled media and activists"],"entities":[{"id":1167,"name":"Unattributed Pegasus customer (possibly a single customer for at least five cases)","role":"actor","entity_type":"Security Apparatus (suspected, unattributed)"},{"id":1168,"name":"Exiled Russian and Belarusian journalists and activists living in the EU: Meduza CEO Galina Timchenko; RFE/RL's Evgeny Erlikh; Novaya Gazeta Europe director Maria Epifanova; Charter97 editor Natallia Radzina; opposition politician Andrei Sannikov; journalist Evgeny Pavlov; two anonymous people in Lithuania","role":"target","entity_type":"Individual — Journalist / Activist (in exile)"}],"date_text":"08/2020","created_at":"2026-09-25T12:58:50.808328+00:00","escalation":5,"harm_track":"Track 3 — Operational Suppression","narratives":[],"report_ids":[],"signal_ids":[],"updated_at":"2026-09-25T12:58:50.808328+00:00","occurred_on":"2020-08-01","campaign_ids":[],"enabler_type":"","response_ids":[],"trigger_type":"TR-08: Proactive / Ambient","campaign_phase":"","civic_response":"Victims went public with Access Now and Citizen Lab (September 2023; May 2024); RSF and CPJ called for thorough investigations by the host states.","date_precision":"month","enabler_status":"","campaigns_served":[],"consequence_category":"Operational Suppression","institutional_consequence":"Data seizure/exposure; Chilling effect on exile media and sources"}