{"id":"SRB-124","notes":"Coded Sep 25 2026. Secondary TC-51: targeting of journalists. Links: SRB-123 (2023 attempts), SRB-122 (NoviSpy/Cellebrite, 2024), SRB-121 (2026 wave). Campaign SRB-CAMP-018. Escalation 3: suspicious spyware link received; no infection. (Spyware thresholds, Sep 25 2026.) UN Special Rapporteurs (15 Sep 2026) cite Pegasus, NoviSpy and Cellebrite UFED together as confirming 'a pattern of unlawful surveillance and intimidation' in Serbia (CR-SRB-003); pattern: SRB-123 (2023), SRB-122 (2024), SRB-124 (2025), SRB-121 (2025–26).","country":"Serbia","sources":[{"url":"https://www.ohchr.org/en/press-releases/2026/09/serbia-use-spyware-against-opposition-and-dissenting-voices-affects","citation":"https://www.ohchr.org/en/press-releases/2026/09/serbia-use-spyware-against-opposition-and-dissenting-voices-affects"},{"url":"https://securitylab.amnesty.org/latest/2025/03/serbia-birn-journalists-targeted-with-pegasus-spyware/","citation":"https://securitylab.amnesty.org/latest/2025/03/serbia-birn-journalists-targeted-with-pegasus-spyware/"},{"url":"https://www.amnesty.org/en/latest/news/2025/03/serbia-birn-journalists-targeted-with-pegasus-spyware/","citation":"https://www.amnesty.org/en/latest/news/2025/03/serbia-birn-journalists-targeted-with-pegasus-spyware/"}],"summary":"On 14 February 2025, two BIRN Serbia journalists received near-identical Viber messages from an unknown Serbian number on the Telekom Srbija network, containing links to a Serbian-language domain that Amnesty International's Security Lab determined with high confidence to be Pegasus (NSO Group) infrastructure. Neither journalist opened the link and no infection was found. Amnesty (27 March 2025) attributed the attempts to Serbian state actors, citing the consistent use of Serbian-language infection domains and the targeting pattern, and called it the third documented Pegasus targeting of Serbian civil society in two years. The Security Information Agency (BIA) did not respond to requests for comment.","tactics":[{"code":"TC-21","role":"primary","label":"Surveillance Infrastructure / Spyware Deployment","needs_review":false},{"code":"TC-51","role":"secondary","label":"Direct Intimidation of Journalists and Civic Actors","needs_review":false}],"version":2,"channels":["One-click spyware attack attempt via Viber message with Pegasus link (Telekom Srbija number)"],"entities":[{"id":1151,"name":"Serbian state actors (Amnesty attribution, high confidence on Pegasus infrastructure); BIA did not respond","role":"actor","entity_type":"Security Apparatus (suspected)"},{"id":1152,"name":"Two investigative journalists of the Balkan Investigative Reporting Network (BIRN) Serbia, including Jelena Veljković","role":"target","entity_type":"Individual — Journalist"}],"date_text":"14/02/2025","created_at":"2026-09-25T12:58:48.165259+00:00","escalation":3,"harm_track":"Track 3 — Operational Suppression","narratives":[],"report_ids":[],"signal_ids":[],"updated_at":"2026-09-25T14:48:23.40409+00:00","occurred_on":"2025-02-14","campaign_ids":["SRB-CAMP-018"],"enabler_type":"","response_ids":[],"trigger_type":"TR-08: Proactive / Ambient","campaign_phase":"","civic_response":"The journalists recognised and did not open the links; BIRN and Amnesty International's Security Lab made the attempts public (27 Mar 2025) and called on Serbia to stop unlawful surveillance of journalists and civil society.","date_precision":"day","enabler_status":"","campaigns_served":[],"consequence_category":"Operational Suppression","institutional_consequence":"Chilling effect"}