In Serbia they "listen", in Montenegro they locate

There is no evidence that Pegasus, a sophisticated secret mobile phone surveillance system, was used in Montenegro, unlike in Serbia, but there is confirmation that users connected to Montenegrin mobile operators were targets of secret location tracking via the international telecommunications network.

A few months before the latest discovery from Serbia, Citizen Lab published research that puts Montenegro on the map of a different and very sophisticated form of surveillance, which was given the technical designation STA1 - Surveillance Threat Actor 1.

The term “Surveillance Threat Actor” - STA can be translated as “surveillance-related threat actor”, or more simply “an actor that carries out surveillance”. Citizen Lab does not use this label to name a specific company, country or intelligence service, but rather technically designates an unknown actor whose behavior and infrastructure can be tracked and linked across multiple incidents. The number “1” only distinguishes this group of activities from other actors that the researchers have identified.

In other words, STA1 is not the name of a spyware program like Pegasus, nor is it the name of an organization, but rather a working codename for an unidentified actor who used sophisticated telecommunications methods to track the location of certain mobile users. Citizen Lab has not publicly identified its real name.

What is Citizen Lab?

Citizen Lab is a research laboratory at the Munk School of Global Affairs & Public Policy at the University of Toronto, specializing in digital espionage, commercial surveillance systems, cyber threats, and attacks on journalists, activists, and other members of civil society. Over the years, the lab has become one of the most renowned international research centers for the technical analysis of Pegasus and other commercial spyware products.

Its experts analyze phones, network infrastructure, servers, telecommunications data and other digital traces to determine whether a specific device or user has been targeted.

Citizen Lab is not a police or intelligence agency, nor does it sell surveillance products.

This is especially important when attributing attacks: researchers can often prove very precisely how someone was monitored, but they cannot always prove with the same certainty who ordered the monitoring.

In the “Bad Connection” report, published on April 23, 2026, researchers --Gary Miller i Swantje Lange analyzed a multi-year campaign of secret surveillance of mobile users.

While in Serbia, it was forensically confirmed that the phone of a student movement member was infected with Pegasus, Citizen Lab researchers discovered another, lesser-known form of sophisticated surveillance in which Montenegro also appears.

A phone can be turned into a surveillance tool without its owner clicking anything, opening a suspicious message, or installing an unknown app.

This is demonstrated by the case from Serbia, which in early September reopened the issue of the use of sophisticated spy technologies in the Western Balkans.

Citizen Lab announced on September 2 that it had confirmed through forensic analysis that the iPhone of a member of the student protest movement in Serbia was infected with Pegasus - one of the most powerful known commercial spyware.

Student Jelena Kontić She then publicly announced that it was her phone. Citizen Lab determined that the device was targeted by a so-called “zero-click” iMessage exploit linked to NSO Group’s Pegasus, meaning the user did not have to click on the link for the attack to succeed. Forensic traces of the infection date back to between December 2025 and January 2026.

Pegasus is made by Israeli company NSO Group. When successfully compromised, it potentially allows an attacker to access messages, photos, and other data, as well as turn on the microphone and camera.

Among the previously known cases is Igor Bozic, former program director of N1 Serbia. Božić announced in early September 2026 that a forensic analysis of his phone, conducted by Amnesty International experts, showed that Pegasus was installed on the device in August 2023, just before the start of the election campaign in Serbia. According to him, the spyware was active for 13 days, until he updated the operating system and thus closed the vulnerability through which the phone was compromised. Božić says that he only learned about the attack about a year later, after he requested a check of the device.

Kontić and Božić are not the only publicly known cases. Amnesty International previously identified a BIRN investigative journalist Jelena Veljkovic and her colleague, identified in the report by a pseudonym "Bogdan", received messages with links related to the Pegasus infrastructure in February 2025. Their phones were not confirmed to be infected, but rather an attempted attack.

The SHARE Foundation reported in September 2026 that at least 14 students, activists, and opposition politicians had been targeted with various types of advanced spyware since the beginning of the year. This does not mean that Pegasus was used in all 14 cases.

"Suspicions without evidence"

President of Serbia Aleksandar Vučić He rejected claims that Serbian authorities were behind the attack, saying that the students had raised “suspicions without any evidence.” He added that he himself had been wiretapped at one point:

"In this country, I was wiretapped when I was the opposition leader."

The Security and Information Agency of Serbia (BIA) reacted similarly. In an official statement on September 3, it called the allegations of the use of spyware "mere trivial sensationalism," adding that it operates "exclusively in accordance with the laws of the Republic of Serbia."

Citizen Lab, however, has not publicly attributed the latest Pegasus infection to the BIA, the Serbian president, or any other specific state institution. Forensic analysis shows that the phone was compromised by Pegasus, but it does not in itself reveal who ordered the attack.

As for Montenegro, there is currently no publicly confirmed evidence that Pegasus was purchased or used by the National Security Agency, the police, or any other institution of Montenegro.

There is also no publicly known case in which forensic analysis of a device confirmed that a person in Montenegro was infected with Pegasus.

Unlike Pegasus, STA1 doesn't have to take control of a phone. Instead, it attempts to exploit the infrastructure through which mobile networks around the world communicate with each other.

And among his targets appears Montenegro.

Citizen Lab says STA1's targets included individual mobile subscribers connected to operators in Thailand, South Africa, Norway, Bangladesh, Denmark, Sweden, Malaysia, Montenegro, and several African countries.

This is the most concrete publicly documented evidence to date that a sophisticated commercial surveillance infrastructure targeted a user or users connected to the Montenegrin mobile network.

Mobile networks have to constantly “talk” to each other. When a person with a Montenegrin SIM card goes to Italy, for example, their phone connects to the Italian network. The Italian and Montenegrin operators have to exchange certain data so that the phone can receive calls, SMS messages, and use the internet.

This uses telecommunications protocols known as SS7 and Diameter.

If someone gains privileged access to the international telecommunications infrastructure, they can try to send requests to the network that appear legitimate, but whose real goal is to find out where a particular phone is located.

It is precisely such a pattern that Citizen Lab has associated with STA1.

STA1 was not a short-lived operation. Citizen Lab found traces of activity dating back to at least November 2022 and identified more than 500 events related to user location in historical data.

The attacker changed operator identities and network paths. When one way was blocked, he would try another.

In one detailed reconstruction of a case against a high-profile Middle Eastern individual, STA1 used different network identities and switched between SS7 and Diameter protocols over several hours, attempting to reach the same individual's location using different routes.

Citizen Lab did not attribute STA1 to any specific government or company.

However, researchers believe that the way individuals were tracked across different networks and countries over an extended period of time fits the pattern of a commercial surveillance platform likely used by multiple clients.

The biggest mystery is who was being tracked in Montenegro. Citizen Lab has not publicly announced which Montenegrin operator was involved, how many subscribers were targeted, when the tracking occurred, whether the phone was in Montenegro or roaming at the time, or whether the tracking attempt was successful.

It is also not known who wanted the user's location data.

The Citizen Lab's formulation also does not necessarily mean that the person in question is a Montenegrin citizen. The target could have been a person using a Montenegrin operator's SIM card, while the phone could have been in another country at the time of the attack.

"Vijesti" is verifying this data with researchers from Citizen Lab and the company Cellusys, whose data from the mobile network protection system was used in the research.

The key questions are which Montenegrin operator the targeted user belonged to, when the attack occurred and, above all, whether the attempt was blocked or whether the attacker managed to obtain location information.

Pegasus i STA1

The difference between Pegasus and STA1 is that Pegasus tries to take control of the phone itself, and STA1 tries to obtain the data needed to locate the user from the telecommunications network.

With Pegasus, the phone can be turned into a means of surveillance for its owner.

With STA1, the phone does not have to be infected. The person can use the device normally and not notice anything, while the monitoring attempt takes place within the international telecommunications infrastructure.

In the investigation so far, "Vijesti" has not found public evidence that any Montenegrin institution has acquired Pegasus or any other NSO Group product.

But the absence of public evidence is not proof that the system was never used.

The complete data from the international Pegasus Project investigation, which relied on more than 50.000 phone numbers selected as possible targets of NSO clients, has never been published in full.

Therefore, the question remains open whether the original data contains a number with the Montenegrin calling code +382 or a person connected to Montenegro who used a number from another country.

"Vijesti" is checking this data with international organizations that participated in the Pegasus Project analysis, as well as the question of whether Israel has ever approved the marketing or export of NSO or other technologies for sophisticated mobile surveillance whose end user would be an institution from Montenegro.

Therefore, the question for Montenegro is not just whether someone bought Pegasus. An equally important question is who was trying to monitor users of Montenegrin mobile networks, when they were doing it, why, and did Montenegrin operators and state institutions know about it?

Artificial intelligence was used to collect data for the text.