---
title: "Cellebrite cut off Serbia in 2025. The labs say its tools ran through the 2026 election anyway"
description: "Cellebrite publicly cut off Serbia in February 2025. Three forensic labs say its extraction tools were used there anyway, into 2026, and the repetition after an earlier cutoff in Russia reads as a claim about the business model, not one bad customer."
publisher: "The Inference"
section: "Security"
published: 2026-10-27T14:36:03.266Z
modified: 2026-10-27T14:36:03.266Z
canonical: https://theinference.org/article/cellebrite-cut-off-serbia-in-2025-the-labs-say-its-tools-ran-through-the-2026-election-anyway
language: en
keywords: "Cellebrite, Spyware, Serbia, Citizen Lab, Surveillance, Elections"
---

# Cellebrite cut off Serbia in 2025. The labs say its tools ran through the 2026 election anyway

> Cellebrite publicly cut off Serbia in February 2025. Three forensic labs say its extraction tools were used there anyway, into 2026, and the repetition after an earlier cutoff in Russia reads as a claim about the business model, not one bad customer.

Serbia's own intelligence agency, the Security Information Agency (BIA), used Israeli phone-extraction vendor [Cellebrite](https://theinference.org/markets/companies/cellebrite)'s hardware during police interrogations to unlock opposition figures' phones and load spyware onto them, and it kept doing so after Cellebrite publicly cut the country off. Citizen Lab, Amnesty International's Security Lab and Belgrade's SHARE Foundation [published synchronized forensic findings on October 26](https://www.techtimes.com/articles/329516/20261027/three-labs-confirm-serbia-hacked-rector-prosecutor-pegasus-before-vote.htm), one day after Aleksandar Vučić conceded the election he lost after 14 years in power [1][2].

## What the labs documented

The forensics confirm a layered operation: Pegasus, the remote-access spyware made by Israel's NSO Group, on iPhones; NoviSpy, a custom Android implant built by the BIA; and Cellebrite's Universal Forensic Extraction Device (UFED), interrogation-room hardware that unlocks a seized phone, pivoting from unlock to spyware install. Amnesty traced that chain through a [Qualcomm](https://theinference.org/markets/companies/qualcomm) kernel flaw, CVE-2024-43047, rated 7.8 on the CVSS severity scale and patched only in October 2024 [1].

![A Cellebrite UFED Physical Pro handheld extraction device](https://storage.googleapis.com/theinference-public/img/01465a464f974a06.jpg)

*A Cellebrite UFED Physical Pro, the interrogation-room hardware the labs say Serbian authorities used to unlock seized phones before loading spyware. (jon crel, CC BY 2.0)*

At least 15 people were targeted in 2026, among them University of Belgrade rector Vladan Đokić, whose office was raided in March, and prosecutor Rade Bajić, who investigated the Kushner-linked Trump Tower deal in Belgrade and was called a criminal on state television by Vučić [1][7]. Amnesty found Cellebrite software still deployed in Serbia weeks after the company [announced in February 2025 it was halting use of its products by certain Serbian customers](https://en.wikipedia.org/wiki/Cellebrite) [2][3].

## The pattern, not the outlier

The Russia precedent is the tell. In June 2026 Citizen Lab [forensically confirmed Russian authorities used a Cellebrite UFED on activist Andrey Pivovarov's iPhone](https://citizenlab.ca/research/russia-breaks-into-human-rights-activists-phone-with-cellebrite/) in June 2021, [months after Cellebrite canceled its Russian contracts](https://theinference.org/article/a-russian-owned-phone-hacking-vendor-collapsed-and-cellebrite-waits-to-inherit-the-vacuum), and Russia's own Ministry of Interior forensic report confirms it; Cellebrite's reply was that post-termination use is "entirely unauthorized" [4].

Citizen Lab's answer cuts to the design flaw: offline mode and legacy architecture made it hard for the company to actually cut anyone off, and its terminations are reactive, coming only after third-party exposure [4]. Serbia fits the same shape: halted in February 2025, still deployed weeks later, documented again in the 2026 chain [1][2][3].

*Chart: **Revenue kept climbing while operating income fell in the last two quarters** Column chart of Cellebrite quarterly revenue and operating income in millions of dollars across eight quarters, revenue rising from 106.9 to 131.1 while operating income falls from 19.5 to 7.0*

*Quarterly revenue and operating income, USD millions, from Cellebrite's SEC filings. Operating income fell in five of the last eight quarters even as revenue rose. [6]*

## What the buyer base is worth

For Cellebrite's customers and shareholders, the compliance regime is the asset being tested, because the company's entire revenue base is government law-enforcement and intelligence buyers, and repeat documented misuse is what invites export limits, procurement reviews and vendor bans in exactly the democracies it sells to. The financials already show strain arriving before any regulator moves.

Revenue grew 15.8 percent year over year to $131.1 million in the quarter ended June 30, 2026, per SEC filings, but operating income fell 51.8 percent and net income fell 67.3 percent [6]. Meanwhile the company's largest market keeps buying: the US Department of Homeland Security renewed an $11 million contract, used primarily by Immigration and Customs Enforcement, in September 2025 [3]. And on August 13, alongside second-quarter results, Cellebrite [lowered its full-year revenue outlook](https://investors.cellebrite.com/news-releases) [5].

## The counterpoint

Cellebrite's defense is coherent on its own terms: it terminated Serbia, it says tools sold before a cutoff work without support or consent, and its ethics committee reviews every sale. All true as far as the record goes. What the record does not carry is a single disclosed instance of the company remotely disabling a misusing customer, or publishing how its ethics committee decides. Citizen Lab notes no detailed public disclosure of those decisions exists [4].

## The verdict watch

Cellebrite reports third-quarter results on November 12 [5]. Two things decide whether this stays a valuation issue or becomes a license issue: whether operating margin keeps compressing while the misuse record grows, and whether any democracy's export regulator or procurement office moves first. The burden sits with the company to show a termination that actually switches the tool off.

## Takeaway

Three labs say Cellebrite's tools kept unlocking opposition phones in Serbia into 2026 despite a February 2025 cutoff, repeating the Russia pattern, and the strain is already showing: operating income halved in Q2 2026 while revenue grew. The next test is the November 12 earnings report and whether any export regulator moves first.

## Sources

1. [Tech Times, Three Labs Confirm Serbia Hacked Rector and Prosecutor With Pegasus Before Vote, 27 October 2026](https://www.techtimes.com/articles/329516/20261027/three-labs-confirm-serbia-hacked-rector-prosecutor-pegasus-before-vote.htm)
2. [The Record, Serbian autocrat loses election following widespread reports of digital repression, 27 October 2026](https://therecord.media/serbia-election-spyware-vucic)
3. [Wikipedia, Cellebrite (accessed 27 October 2026), citing Amnesty International, 26 February 2025](https://en.wikipedia.org/wiki/Cellebrite)
4. [Citizen Lab, Russia Breaks Into Human Rights Activist's Phone With Cellebrite, 25 June 2026](https://citizenlab.ca/research/russia-breaks-into-human-rights-activists-phone-with-cellebrite/)
5. [Cellebrite Investor Relations, News Releases, accessed 27 October 2026](https://investors.cellebrite.com/news-releases)
6. [Cellebrite, quarterly figures from SEC filings, retrieved 27 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001854587)
7. [The Record, Two more Serbian opposition figures targeted with spyware, researchers say, 19 October 2026](https://therecord.media/serbia-spyware-pegasus-elections)


---

Cellebrite cut off Serbia in 2025. The labs say its tools ran through the 2026 election anyway — The Inference. Canonical: https://theinference.org/article/cellebrite-cut-off-serbia-in-2025-the-labs-say-its-tools-ran-through-the-2026-election-anyway