- summary
- Access Now and Citizen Lab found that exiled Russian- and Belarusian-speaking journalists and activists based in Latvia, Lithuania and Poland were targeted and, in most cases, infected with NSO Group's Pegasus between August 2020 and January 2023. Meduza's Galina Timchenko was infected around 10 February 2023 while in Berlin (first documented Pegasus use against exiled Russian media, published September 2023). Forensic artefacts suggest, without proving, that at least five cases came from a single NSO customer; no operator has been attributed, and neither Russia nor Belarus is a known Pegasus customer.
- country
- Europe (transnational)
- date text
- 08/2020
- entities
- Unattributed Pegasus customer (possibly a single customer for at least five cases)
- entity type
- Security Apparatus (suspected, unattributed)
- id
- 1167
- name
- Unattributed Pegasus customer (possibly a single customer for at least five cases)
- role
- actor
- Exiled Russian and Belarusian journalists and activists living in the EU: Meduza CEO Galina Timchenko; RFE/RL's Evgeny Erlikh; Novaya Gazeta Europe director Maria Epifanova; Cha…
- entity type
- Individual — Journalist / Activist (in exile)
- id
- 1168
- name
- Exiled Russian and Belarusian journalists and activists living in the EU: Meduza CEO Galina Timchenko; RFE/RL's Evgeny Erlikh; Novaya Gazeta Europe director Maria Epifanova; Charter97 editor Natallia Radzina; opposition politician Andrei Sannikov; journalist Evgeny Pavlov; two anonymous people in Lithuania
- role
- target
- Unattributed Pegasus customer (possibly a single customer for at least five cases)
- sources
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Direct Intimidation of Journalists and Civic Actors
- label
- Direct Intimidation of Journalists and Civic Actors
- code
- TC-51
- needs review
- false
- role
- secondary
- Surveillance Infrastructure / Spyware Deployment
- channels
- Covert spyware infection (Pegasus) of exiled media and activists
- civic response
- Victims went public with Access Now and Citizen Lab (September 2023; May 2024); RSF and CPJ called for thorough investigations by the host states.
- consequence category
- Operational Suppression
- created at
- 2026-09-25T12:58:50.808328+00:00
- date precision
- month
- escalation
- 5
- harm track
- Track 3 — Operational Suppression
- id
- EUR-001
- institutional consequence
- Data seizure/exposure; Chilling effect on exile media and sources
- notes
- Coded Sep 25 2026. New pattern: transnational repression in exile — people are safe on EU soil but their phones are not. Country recorded as 'Europe (transnational)' (victims in Latvia, Lithuania, Poland; Timchenko infected in Germany). Pavlov and one Lithuanian person: targeted only.
- occurred on
- 2020-08-01
- trigger type
- TR-08: Proactive / Ambient
- updated at
- 2026-09-25T12:58:50.808328+00:00
- version
- 1
The public research collection