Threat Actor Characterization
PEARL
ID: 1d59b3c4c31db1cf1cc94c1c1445509784420Actor Network Graph
Open Network GraphMITRE ATT&CK®
PEARL is a Citizen Lab-designated Pegasus operator historically associated with surveillance focused on Bahrain and Qatar and assessed as part of a Bahrain-linked government spyware customer environment.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1583 | Acquire Infrastructure | TA0042 |
|
| T1589 | Gather Victim Identity Information | TA0043 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1071 | Application Layer Protocol | TA0011 |
|
| T1005 | Data from Local System | TA0009 |
|
| T1119 | Automated Collection | TA0009 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Mercenary Spyware / Government Pegasus Operator
Assessed Origin: Bahrain (high-confidence analytical linkage to a Bahraini government Pegasus customer environment)
Executive Summary
PEARL is the name assigned by Citizen Lab to an earlier Pegasus operator associated with surveillance activity focused on Bahrain and Qatar. Public reporting places the operator active since at least July 2017 and identifies it as part of the wider NSO Group Pegasus ecosystem discovered through Internet scanning, clustering, and DNS cache probing. Unlike overt criminal or hacktivist groups, PEARL had no public brand, manifesto, or leak identity; its relevance lies in selective surveillance, state-linked targeting patterns, and the political sensitivity of its apparent victim environment.
PEARL is analytically significant because it appears to represent an early Bahrain-linked Pegasus operational cluster preceding, and potentially overlapping with, the later LULU operator. Public reporting indicates that PEARL spied exclusively in Bahrain and Qatar and was active during a period of intensifying repression against opposition political societies, activists, journalists, lawyers, and civil-society voices in Bahrain. The target environment described in later reporting includes members of Waad and Al Wefaq, both politically sensitive groups in the Bahraini context.
Executive Analyst Brief for Decision Makers — PEARLClassification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITEThreat Type: Government Pegasus operator / mercenary spyware customer clusterWhat happenedPEARL is the designation assigned to an earlier Pegasus operator associated with surveillance activity focused on Bahrain and Qatar. Public reporting places the operator active since at least July 2017 and links it to the broader Bahrain-linked Pegasus customer environment
Hunting Playbook — PEARL
Scope: This playbook is oriented to high-risk-person defense, mobile threat monitoring, proxy/DNS telemetry review, and incident-response support for suspected Pegasus-style surveillance linked to PEARL. It is not a generic enterprise ransomware or Windows intrusion playbook.
IOC Appendix — PEARL
PEARL is a historical Pegasus operator designation, not a public malware family or branded criminal service. Public reporting provides strong analytical value around geography, surveillance purpose, and operator lineage, but relatively sparse PEARL-specific hard indicators compared with later operator reporting. Any operational use of indicators in this appendix should therefore emphasize hunting, enrichment, and contextual triage rather than simple blocking logic.