Court Reveals Insights on Attacks Targeting 1,223 WhatsApp Users with Pegasus Spyware

A recent court document has unveiled critical information regarding surveillance attacks on WhatsApp users, revealing that 1,223 individuals across 51 countries were targeted in just two months. This information emerged during the ongoing legal dispute between Meta Platforms, the parent company of Facebook, and the Israeli spyware firm NSO Group. The document details the locations of the victims, the servers used for the attacks, and the origins of the spyware assaults exploiting a vulnerability in WhatsApp.

In a complaint filed back in 2019, Facebook had already indicated that around 1,400 users were affected. The targeted individuals included journalists, lawyers, human rights advocates, and government critics, as well as officials and military personnel from at least 20 nations. The latest court documents indicate where these victims were located during the hacking campaign that occurred in April and May of 2019.

Among the countries with the highest number of victims, Mexico led with 456 identified individuals. Other notable locations included India with 100 victims, Bahrain with 82, Morocco with 69, Pakistan with 58, Indonesia with 54, and Israel with 51 victims. Additionally, there were cases reported in Cyprus (31), Turkey (26), and several Western European countries, including Spain (21), the Netherlands (11), France (7), Belgium (4), Finland (4), Switzerland (3), and two cases each in Germany and the United Kingdom.

Runa Sandvik, a security expert, pointed out that numerous articles have highlighted the use of Pegasus for targeted attacks on victims worldwide. However, many reports fail to capture the full extent of these attacks, including the number of victims who were not notified or did not publicly share their experiences. The current data, particularly the high number of cases in Mexico, underscores the serious implications of spyware issues globally.

Moreover, the document also discloses the potential origins of the attacks. According to WhatsApp, 60 of the attacks originated from Sweden, 56 from Cyprus, 39 from the Netherlands, and 9 from Indonesia. This information is not exhaustive, but it illustrates that attackers and their victims often reside in different countries. Notably, there were no recorded victims from Sweden despite numerous attacks originating there, and the number of attacks from the Netherlands significantly exceeded the number of victims from that country.

The command-and-control (C2) infrastructure utilized for these attacks is globally dispersed. These C2 servers mimic regular data traffic to remain undetected while allowing for covert surveillance. WhatsApp identified multiple C2 servers located in Hungary and the UK, with additional servers in the Netherlands and Sweden, and one identified in Germany.

In response to the allegations, a spokesperson for NSO Group stated that the list of attacks provided for examination was based on misinterpretations and selective claims from Meta that have been previously disputed in court. They emphasized that identifying the location of a suspect's device does not necessarily indicate the identity of the customer behind the attack.

In late 2024, a US district court ruled in favor of WhatsApp against NSO Group, condemning the spyware manufacturer for computer fraud and abuse. The court proceedings this year will focus solely on the determination of damages. The ongoing case (Case No. 19-cv-07123) continues to unfold, with NSO Group actively contesting the court's decisions.