Analysis published in May 2022 by Alexandru Angheluș, Oana Buzianu and Aris Giannopoulos. The full document is available below.

In 2022, source code advertised as “Pegasus” was published on Telegram. Since NSO Group’s Pegasus is one of the most dangerous espionage tools known, able to compromise a phone with a single message and no click, the leak looked like a chance to understand how it works. The analysis showed something else: the code belonged to a remote administration tool also called Pegasus, not to NSO’s zero-click spyware.

Key points

• NSO’s Pegasus is zero-click spyware: receiving a message can be enough to compromise the device.
• The leaked project was “Pegasus Remote Control” by Skynet Software Corp (2020), with remote desktop, a cryptocurrency miner and a RAT component.
• Subfolder names written in “Greeklish” suggest that at least one author or later contributor was of Greek origin.
• The post had about 6,600 views in two days, so the code could reach other criminals.
• It is better that the real Pegasus code was not the one leaked.

What the leak contained

The files included folders named PEGASUS, Server and HVNC, which looked promising at first. The version information told a different story: “Pegasus Remote Control”, created by Skynet Software Corp in 2020. The project included an option to use the victim’s device to mine cryptocurrency, which makes no sense for discreet state-level espionage. Its components were a Windows remote desktop manager, AsyncMod Miner and BitRAT.

Public sources described the tool’s features: user-level rootkit, hidden remote desktop (HVNC and hidden RDP), cryptocurrency wallet theft, remote recovery and a builder. It is an espionage and control tool for cybercriminals, but not one used against politicians, institutions or journalists.

A clue about the authors

Some subfolders had Greek names written in Latin characters, a practice known as Greeklish: Cryptografhsh (encryption), Diadyktio (network), Metafora_Dedomenon (data transfer), Metafora_Eikonas (image transfer), Metafora_kwdika (code transfer). This suggests that the author, or someone who later modified the code, may be of Greek origin.

Full document

How to protect yourself from spyware

• keep the phone and apps updated and install security patches as soon as they appear;
• restart the phone daily, which can interrupt some in-memory infections;
• do not click links received by message or email;
• install a security app that warns if the device is rooted or jailbroken;
• on iPhone, consider disabling iMessage and FaceTime if you are at high risk, or use Lockdown Mode;
• use a reputable paid VPN on untrusted networks.

Classic remote administration tools can be detected by security software, and users can be taught to avoid them. Zero-click spyware is much harder to defend against, which is why the real Pegasus has so far been used only against selected targets. For the analysis of a device or file you suspect is compromised, ProDefence offers malware and fraud analysis.