On 3 July 2026, the research group Citizen Lab published forensic analysis with a notable finding. A former Member of the European Parliament, Stelios Kouloglou, was repeatedly infected with Pegasus spyware while serving on the parliamentary committee established to investigate Pegasus abuse.
The infections were dated to October 2022 and March 2023. Forensic work confirming them was completed only in May 2026. As Al Jazeera reported, a lawmaker investigating surveillance was himself under surveillance and didn’t know it for about three and a half years.
The TSCM significance for organisations, not only public figures
It would be easy to read this as a matter of high politics, relevant to MEPs and journalists rather than to businesses. That reading overlooks the detail that makes the case genuinely instructive.
This was a target with every reason to be careful. He sat on a committee whose entire purpose was investigating this exact spyware. He received multiple threat notifications from Apple across 2023 and 2024. And still, the gap between infection and detection was around three and a half years. If someone that alert, that close to the subject, can be compromised and stay compromised for years, the assumption that you would simply know is not a safe one.
There is a Cyprus thread here too. The committee’s work, and its draft report, covered several countries including Cyprus, and the committee visited Cyprus and Greece in November 2022 as part of its inquiry. Surveillance of this kind is not a distant concern; it has touched the region directly.
Digital spyware and physical surveillance are two halves of one problem
Pegasus is software: it infects a phone and turns it into a listening and tracking device without anything physical being planted. A traditional bug is hardware: a microphone, a camera or a transmitter placed in a room or a vehicle. They are different disciplines, but for anyone protecting confidential information, they are two halves of the same problem, which is unauthorised access to private conversations.
A serious approach to counter-surveillance treats both. Device security, threat-notification vigilance and disciplined communications habits address the digital side. Physical TSCM inspections address the hardware side: the boardroom, the office, the vehicle.
The BlackWolf perspective: bug detection is the weak link
The lesson we draw at BlackWolf Private Security is not that surveillance is unstoppable. It is that detection is the weak link, and the answer is to shorten the gap between compromise and discovery.
For a business, that means not relying on the assumption that you would notice. It means routine, scheduled inspection of the spaces where sensitive decisions are made, rather than waiting for a reason. The Pegasus case is an extreme illustration of a general truth: the longer a device or an infection goes unchecked, the more it collects. Regular checks are what keep that window short.
Our TSCM and counter-surveillance service covers the physical side of that picture across Cyprus: inspecting boardrooms, offices and vehicles for hidden microphones, cameras and trackers, using government-standard equipment, with a team trained and licensed to international standards. For the digital side, we advise clients on sensible device and communications practices as part of the same conversation.
To arrange a confidential TSCM inspection, contact BlackWolf: info@blackwolf.com.cy