The investigation, led by the human rights organization Access Now, the Citizen Lab at the University of Toronto, and independent researcher Nikolai Kvantaliani, has found that victims, known for their independent journalism and activism, had their phones hacked by spyware between August 2020 and January 2023, while they were all living in either Latvia, Poland and Lithuania.

Pegasus can hack into smartphones in order to gain access to information and eavesdrop on conversations.

The Israeli-made spyware shot to prominence in Poland after a Citizen Lab investigation found that a number of people linked to the then opposition had had their phones infected with it.

Most of the new victims left Russia or Belarus either before or after the Russian invasion of Ukraine owing to threats from local law enforcement inside their home country, or were branded as “foreign agents.”

The report says that while the spyware attacks were initiated as early as 2020, they intensified following Russia’s invasion of Ukraine in 2022.

A joint investigation by Access Now and Citizen Lab had earlier revealed the use of Pegasus spyware against Galina Timchenko, CEO of Meduza, an independent Latvia-based media outlet that focuses on Russian affairs.

The latest victims include five journalists and two activists. While two of the victims have opted to remain anonymous, the others are willing to be identified. The list of victims includes Evgeny Erlik, an Israeli-Russian journalist who is associated with Radio Free Europe, and Natallia Radzina, a Belarusian journalist who is the editor-in-chief of the independent Belarusian news outlet Charter97.org. She resides in Warsaw, Poland.

Who could be behind it?

Just who is behind the hacking remains unclear.

Access Now and Citizen Lab have not named a specific operator who could have been behind the attacks, they do state in their report that it is unlikely that it could have been Poland.

The report adds that given that there is no documented evidence of the country targeting victims beyond its borders with Pegasus spyware, coupled with reports indicating that the government in Warsaw ceased the use of the spyware in 2021, it is improbable that Poland is responsible for the attacks outlined in the investigation.

Additionally, according to the Citizen Lab, there is no indication that Russia, Belarus, or Lithuania are Pegasus customers. It adds that although Latvia is known to employ Pegasus, it is not known for targeting victims outside its borders.

However, it also reports that Estonia does extensively utilize Pegasus outside its borders, including within various European countries.