Threat Actor Characterization
LULU
ID: 10638edc04936833c872461c8dfb5def93019Actor Network Graph
Open Network GraphMITRE ATT&CK®
LULU is a Pegasus operator attributed with high confidence to the Government of Bahrain and linked to targeted iPhone compromises of Bahraini activists between June 2020 and February 2021 using zero-click iMessage exploit chains including KISMET and FORCEDENTRY.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1203 | Exploitation for Client Execution | TA0002 |
|
| T1566.002 | Spearphishing Link | TA0001 |
|
| T1583 | Acquire Infrastructure | TA0042 |
|
| T1071 | Application Layer Protocol | TA0011 |
|
| T1005 | Data from Local System | TA0009 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Mercenary Spyware / Government Pegasus Operator
Assessed Origin: Bahrain (high-confidence attribution to the Government of Bahrain)
Executive Summary
LULU is the name assigned by Citizen Lab to a Pegasus operator attributed with high confidence to the Government of Bahrain. Public forensic reporting indicates that this operator successfully hacked the iPhones of at least four Bahraini activists between June 2020 and February 2021 and was part of a broader wave in which nine Bahraini activists were confirmed as Pegasus victims during that period. The cases are strategically significant because they show sustained government-linked use of NSO Group’s spyware against civil-society and political-opposition targets, including members of Waad, the Bahrain Center for Human Rights (BCHR), exiled dissidents, and an Al Wefaq member.
The operator’s tradecraft was consistent with high-end mobile surveillance rather than broad cyber disruption. Public reporting tied LULU activity to Pegasus delivery infrastructure and to zero-click iMessage exploitation chains, including KISMET in 2020 and FORCEDENTRY in 2021. At least one case also showed an operational fallback to one-click SMS delivery after an iOS upgrade appears to have reduced the effectiveness of the prior zero-click chain. This pattern indicates an operator focused on persistent intelligence collection against specific individuals rather than broad criminal monetization or destructive impact.
Hunting Playbook — LULU
Scope: This playbook is designed for organizations protecting high-risk iPhone users and for DFIR / threat hunting teams conducting retrospective checks for Bahrain-linked Pegasus activity associated with the operator designated LULU. It focuses on forensic triage, mobile telemetry review, and external infrastructure correlation rather than traditional Windows / Linux endpoint hunting.
IOC Appendix — LULU (TLP:WHITE)
Scope & Caveats. LULU is a government-linked Pegasus operator rather than a conventional malware family with stable public samples and broad reusable indicators. As a result, the most defensible indicators are historical infrastructure elements, forensic strings, exploit-era behavioral patterns, and victimology-linked context from Citizen Lab’s reporting. Many items below are best used for retrospective hunting and case enrichment rather than durable blocking. Historical Pegasus infrastructure also churns quickly, and some domains / IPs may no longer be under actor control.