Pegasus infection of PEGA-Committee MEP Stelios Kouloglou

Government and public administration took three distinct hits this week — a Swiss cantonal leak-site claim, a Pegasus-infected MEP, and a US federal info-sharing breach

Three unrelated events this week share one thing: the victim is a public institution, and each demonstrates a different way government is reached — extortion branding, mercenary spyware, and inter-agency trust boundaries. For a Swiss federal SOC the value is the pattern across the target class, not any single incident.

A Swiss cantonal department on a leak site (unconfirmed). MedusaLocker listed a victim "Bd" with domain bd.zh.ch — the Baudirektion of the Canton of Zürich — on 2026-07-01, claiming 772 extracted emails, as part of a batch-style posting wave that also listed a French municipality and other European entities in immediate succession (Ransomware.live, 2026-07-01). This is a dark-web claim only: no cantonal statement, no NCSC.ch (BACS) advisory, no independent Swiss press coverage exists in-window. It is a situational-awareness signal for cantonal-government readers, not a confirmed breach — but batch-listing of European public bodies is itself the operational note (§ references).

A Pegasus-infected European Parliament oversight member. Citizen Lab confirmed with high confidence that the iPhone of former MEP Stelios Kouloglou — who sat on the Parliament's PEGA committee investigating commercial-spyware abuse — was infected with NSO Group's Pegasus twice (Oct 2022 and Mar 2023) via the zero-click PWNYOURHOME chain (a crafted NSKeyedArchive landing in the HomeKit daemon, then malicious content in MessagesBlastDoorService) (Citizen Lab, 2026-07-03). The targeting infrastructure overlaps a Pegasus operator also hitting Russian/Belarusian-speaking exiles in Europe. Infecting the person scrutinising spyware abuse is an EU parliamentary-privilege concern, and the defensive surface for high-risk officials is proactive mobile forensics plus enforced Lockdown Mode — not endpoint alerting.

A US federal information-sharing platform. DHS confirmed a breach of the Homeland Security Information Network — the platform federal/state/local/international/private-sector partners use to exchange sensitive-but-unclassified information — with intrusion believed to be late-May–early-June and a SharePoint collaboration system implicated; DHS says no classified networks were impacted (BleepingComputer, 2026-07-01). Both this and HSIN's 2023 incident trace to collaboration-platform trust boundaries rather than perimeter exploitation.

Builds on: 2026-07-02/medusalocker-leak-site-lists-the-canton-of-z-rich-s-baudirek · 2026-07-03/citizen-lab-pega-committee-mep-infected-with-pegasus · 2026-07-02/dhs-confirms-a-breach-of-the-homeland-security-information-n

Citizen Lab: a European Parliament spyware-inquiry member was himself infected twice with Pegasus

Citizen Lab published a forensic report confirming, with high confidence, that the iPhone of Stelios Kouloglou — a former MEP who sat on the European Parliament's PEGA committee, the inquiry into commercial-spyware abuse — was infected with NSO Group's Pegasus on two occasions, around 21 October 2022 and 6–7 March 2023, while the device ran iOS 15.5 (Citizen Lab, 2026-07-03). The 2022 infection used the PWNYOURHOME zero-click chain: a specially crafted NSKeyedArchive object landing in the HomeKit daemon, followed by malicious content processed by MessagesBlastDoorService (iMessage's sandboxed attachment parser) — a distinct path from earlier NSO chains that abused iMessage directly. Citizen Lab does not attribute the intrusion to any government and explicitly found no indication of Greek-government responsibility, but notes the targeting infrastructure overlaps a previously documented Pegasus campaign against Russian- and Belarusian-speaking exiled journalists and opposition figures in Europe, suggesting a single Pegasus customer with multi-country authorization (The Record, 2026-07-03). Because Kouloglou sat on the committee scrutinising exactly this abuse, the operator would have gained visibility into confidential PEGA deliberations — an EU parliamentary-privilege and confidentiality concern.