In an investigative collaboration with Access Now, the Citizen Lab analyzed forensic artifacts from the iPhone of award-winning exiled Russian investigative journalist Galina Timchenko and determined with high confidence that it was infected with NSO Group's Pegasus spyware on or about February 10, 2023. Click here to read Access Now's full investigation into the case.

During the infection, her device was located in the time zone GMT+1 and she reports that she was in Berlin, Germany. The day after the infection, she was due to attend a private meeting with other heads of Russia's independent media exiled in Europe to discuss how to deal with Putin's regime's threats and censorship. We believe that infection may have lasted days to weeks after initial exploitation.

The infection was carried out via a zero-click exploit, and forensic traces allow us to conclude with moderate confidence that it was achieved via the PWNYOURHOME exploit, targeting Apple's HomeKit and iMessage.

Timchenko is the co-founder, CEO and publisher of Meduza, a prominent Russian independent media outlet exiled in Europe and labeled “an undesirable organization” by the Russian government. Timchenko is the recipient of the Committee to Protect Journalists Gwen Ifill Press Freedom Award.

While there are several possible hypotheses that a government client of NSO Group may have been responsible for this hacking (see Access Now's investigation for discussion), we are unable to make a conclusive technical determination regarding attribution at this time.

Do you think you are at risk? Take action We urge anyone at risk of being hacked because of who they are or what they do to seek expert support and take steps to improve the security of their phones.

Enable Lockdown Mode As in many recent cases, we believe that Apple's Lockdown Mode would have mitigated this attack. Click for instructions on how to enable Lockdown mode.

Be Vigilant for Apple Notifications Apple continues to notify victims targeted by certain types of mercenaries, including NSO's Pegasus. If you or someone you know has received such a notification, please take it seriously. We strongly encourage you to contact organizations such as the Citizen Lab or Access Now's Digital Security Helpline if you fall within their mandate (i.e. members of civil society are likely to be at high risk of such attacks), so you can get more clarity and possibly help protect others.

Seek expert help While Lockdown Mode is an example of a strong security step and some users may receive notifications, we cannot be sure that Lockdown Mode will always work, or that you will receive a notification. We strongly recommend that you seek expert assistance if you or your organization are faced with increased risks. A number of NGOs, including Access Now, operate helplines that can assist high-risk users in civil society.