Pegasus Operator Targeting PEGA Member Kouloglou Also Hit Belarus Journalists 2020-2023

Forensic analysis by Citizen Lab matched the operator's unique targeting email and infrastructure to prior infections of seven Russian and Belarusian journalists and opposition figures from August 2020 through January 2023. The same email vector appeared across both campaigns, narrowing the customer pool to entities with multi-country Pegasus licensing. Kouloglou received three prior Apple spyware alerts that went unseen.

Greece's Intellexa-linked domestic scandal does not match the Pegasus customer profile here. Official Greek statements deny involvement in PEGA-related targeting while the Commission has ignored the committee's May 2023 recommendations on export controls and judicial oversight. This creates a documented feedback loop where investigators of commercial spyware become priority targets.

The pattern indicates operators treat parliamentary scrutiny itself as an intelligence requirement rather than a deterrent. Future infections are likely among remaining PEGA members or staff handling follow-up legislation, especially those with Apple devices lacking recent lockdownd updates.

Independent technical evidence shows operator continuity across EU and post-Soviet targets; no public attribution to a specific state exists beyond Kouloglou's unverified Greek government claim.