Purported Graphite Spyware Linked to Paragon Solutions Allegedly Deployed Against Journalists and Civil Society Workers

Summary

Researchers at Citizen Lab and Censys reportedly identified spyware infections involving Graphite, a tool attributed to Israeli firm Paragon Solutions. The spyware was allegedly deployed against civil society actors, including journalists and aid workers, through a zero-click WhatsApp exploit. WhatsApp notified over 90 targeted individuals. Evidence reportedly suggests deployments in multiple democratic countries.

Developers

• REDLattice
• Paragon Solutions

Deployers

• York Regional Police Service (Ontario, Canada)
• Unidentified law enforcement or intelligence entity (Singapore)
• Unidentified law enforcement or intelligence entity (Israel)
• Unidentified law enforcement or intelligence entity (Denmark)
• Unidentified law enforcement or intelligence entity (Cyprus)
• Unidentified law enforcement or intelligence entity (Australia)
• Peel Regional Police (Ontario, Canada)
• Ontario Provincial Police
• Hamilton Police Service (Ontario, Canada)
• External Intelligence and Security Agency (Italy)
• AISE

Harmed parties

• Refugees in Libya
• National security and intelligence stakeholders
• Mediterranea Saving Humans
• Luca Casarini
• Journalists
• Humanitarian workers
• Giuseppe "Beppe" Caccia
• General public of countries in which Graphite is being deployed
• Francesco Cancellato
• Fanpage.it
• David Yambio
• Civil society workers
• Ciro Pellegrino
• Activists
• Privacy

Tags

• Surveillance
• Surveillance of civilians
• Privacy violation
• Unauthorized data collection
• Chilling effect on journalism and activism
• Exploitation of software vulnerabilities
• Cross-border surveillance
• Use of zero-click exploits
• Malware deployment via messaging apps
• Law enforcement and intelligence operations
• Civil society and press freedom
• Messaging and communication platforms
• Mobile device security
• Government surveillance technology
• International spyware supply chains
• AI-enabled spyware
• Behavioral monitoring via mobile sensors
• Inference from app usage data
• Zero-click mobile infection mechanisms
• Malware persistence and sandbox escape techniques
• Zero-day PDF exploit delivered via WhatsApp
• Zero-click infection vector
• Abuse of legitimate messaging app infrastructure
• Impersonation via WhatsApp group invitations
• Journalists
• Humanitarian aid workers
• Civil society actors
• Migrant rescue NGOs
• Italian press and nonprofit leaders
• Australia
• Canada
• Cyprus
• Denmark
• Israel
• Singapore
• SMALLPRETZEL
• BIGPRETZEL
• syndicated