Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations
Essential information
- Published
- 19/03/2025 21:59
- Modified
- 20/03/2025 09:13
- Tags
- 2025-03-19 canada cybersecurity graphite human rights italy law-enforcement spyware surveillance zero-click exploit
- Related entities
- 22 observables, 1 intrusion sets (apt), 1 malware, 9 others
Description
The report investigates Paragon Solutions, an Israeli spyware company founded in 2019 that sells a product called Graphite. Through infrastructure analysis, the researchers identified potential Paragon deployments in several countries. They also found evidence linking Paragon to the Canadian Ontario Provincial Police. Working with WhatsApp, they discovered and mitigated a Paragon zero-click exploit targeting civil society members. Forensic analysis of Android devices in Italy confirmed Paragon infections. The report also examines a potentially related iPhone spyware case. It highlights Paragon's targeting of individuals involved in migrant rescue operations in the Mediterranean, raising questions about the company's claims of only selling to customers respecting human rights. The findings challenge Paragon's marketing approach and demonstrate the ongoing risks of mercenary spyware abuse, even in democracies.