{"id":10760,"date":"2025-03-19T12:44:51","date_gmt":"2025-03-19T12:44:51","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/researchers-id-potential-paragon-spyware-buyers\/"},"modified":"2025-03-19T12:44:51","modified_gmt":"2025-03-19T12:44:51","slug":"researchers-id-potential-paragon-spyware-buyers","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/researchers-id-potential-paragon-spyware-buyers\/","title":{"rendered":"Researchers ID Potential Paragon Spyware Buyers"},"content":{"rendered":"\n<\/p>\n

Introduction<\/h1>\n

According to a recent technical report by The Citizen Lab, a prominent digital security research group, the governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are potential customers of Paragon Solutions, an Israeli spyware manufacturer.<\/p>\n

Background<\/h1>\n

On Wednesday, The Citizen Lab, a team of academics and security researchers at the University of Toronto, released a report about Paragon, a surveillance startup founded in Israel, revealing that these six governments are suspected of deploying Paragon’s spyware.<\/p>\n

WhatsApp Notifications and Scandal<\/h1>\n

In late January, WhatsApp informed around 90 users that they were targeted with Paragon spyware, prompting a scandal in Italy, where some of the targets reside. This incident led to a public outcry and raised concerns about the use of spyware by governments.<\/p>\n

Paragon’s Claims of Responsibility<\/h1>\n

Paragon has attempted to differentiate itself from competitors like NSO Group by claiming to be a more responsible spyware vendor. In 2021, a senior Paragon executive stated that the company would never sell its products to authoritarian or non-democratic regimes.<\/p>\n

Response to Scandal<\/h1>\n

In response to the scandal, Paragon’s executive chairman, John Fleming, told TechCrunch that the company only licenses its technology to a select group of global democracies, primarily the United States and its allies.<\/p>\n

Acquisition by US Venture Capital<\/h1>\n

In late 2024, Israeli news outlets reported that US venture capital firm AE Industrial Partners had acquired Paragon for at least $500 million upfront.<\/p>\n

Citizen Lab’s Investigation<\/h1>\n
\"an
An example of the attack flow for the Graphite spyware.<\/span>Image Credits:<\/strong>Citizen Lab<\/span><\/figcaption><\/figure>\n

Mapping Paragon’s Server Infrastructure<\/h1>\n

The Citizen Lab report reveals that the researchers were able to map Paragon’s server infrastructure used for its Graphite spyware tool, based on a tip from a collaborator.<\/p>\n

Evidence and Fingerprints<\/h1>\n

By developing fingerprints to identify Paragon servers and digital certificates, Citizen Lab found several IP addresses hosted at local telecom companies, which they believe belong to Paragon customers.<\/p>\n

Response from Governments and Paragon<\/h1>\n

TechCrunch reached out to the governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore, as well as the Ontario Provincial Police, but none responded to requests for comment.<\/p>\n

Paragon’s executive chairman, John Fleming, stated that Citizen Lab provided limited information, some of which appears to be inaccurate, and therefore, the company cannot offer a comment at this time.<\/p>\n

Collaboration and Information Sharing<\/h1>\n

Citizen Lab noted that all the individuals notified by WhatsApp who reached out for phone analysis used Android phones, allowing researchers to identify a forensic artifact left by Paragon’s spyware, codenamed “BIGPRETZEL”.<\/p>\n

Meta’s Statement<\/h1>\n

Meta spokesperson Zade Alsawah confirmed that the company believes the indicator Citizen Lab refers to as BIGPRETZEL is associated with Paragon, emphasizing the need for commercial spyware companies to be held accountable.<\/p>\n

Ongoing Investigation<\/h1>\n

Given that Android phones may not always preserve certain device logs, Citizen Lab suggests that more people may have been targeted by the Graphite spyware without evidence of Paragon’s spyware on their phones.<\/p>\n

Targeting Specific Apps<\/h1>\n

Citizen Lab found that Paragon’s Graphite spyware targets and compromises specific apps on the phone without needing any interaction from the target, rather than compromising the wider operating system and device data.<\/p>\n

Conclusion<\/h1>\n

Bill Marczak, a senior researcher at Citizen Lab, stated that while Paragon’s spyware may be trickier to spot than competitors, collaboration and information sharing can help unravel even the toughest cases.<\/p>\n

Call to Action<\/h1>\n
\n

Contact Us<\/h4>\n

Do you have more information about Paragon and this spyware campaign? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email<\/a>. You can also contact TechCrunch via SecureDrop<\/a>. <\/div>\n\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Introduction According to a recent technical report by The Citizen Lab, a prominent digital security research group, the governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are potential customers…<\/p>\n","protected":false},"author":0,"featured_media":10761,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47],"tags":[435,2586,674,368,1296,667,668,180,367,768],"class_list":["post-10760","post","type-post","status-publish","format-standard","has-post-thumbnail","category-news","tag-android","tag-australia","tag-canada","tag-israel","tag-italy","tag-paragon","tag-paragon-solutions","tag-privacy","tag-spyware","tag-surveillance"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/android-spyware-green.jpg","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10760","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=10760"}],"version-history":[{"count":0,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10760\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/10761"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=10760"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=10760"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=10760"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}