Pegasus · CuraSec

tag: Pegasus · 2 items

Engineer — Learn: Confirms Pegasus zero-click exploits against iOS remain active in 2026; no CVE or patch detail is disclosed, so there is no immediate patching action, but this is a prompt to verify executive and sensitive-role devices are on current iOS releases.
SOC/IR — Learn: No IOCs or ATT&CK-mappable TTPs are published with this report; useful background on Pegasus tradecraft and zero-click delivery, but yields no immediate detection or hunt action for an enterprise SOC.
Leader — Learn: Reinforces that Pegasus-class surveillance is actively deployed against civil-society and institutional targets; worth referencing in executive mobile-security briefings, but no board-level action is warranted unless the organization serves a high-risk political or NGO sector.

Engineer — Learn: A zero-click iMessage exploit was used to deploy Pegasus, reinforcing the case for enabling Lockdown Mode on devices belonging to high-risk individuals (executives, journalists, legal); no CVE or patch is identified in this report to act on directly.
SOC/IR — Plan: Citizen Lab reports high-confidence indicators from this infection — review the full Citizen Lab report for published IOCs and build or tune a detection for Pegasus-associated network beacons if you defend any high-profile or at-risk individuals in your estate.
Leader — Learn: Ongoing confirmed Pegasus deployment against civil-society targets is a governance data point; organizations with journalists, activists, or high-profile executives should review whether Lockdown Mode or equivalent MDM hardening is policy for those roles.