Loading threat actor…
Paragon, also known as Paragon Solutions and tracked in some contexts as a private sector offensive actor, is an Israeli commercial spyware vendor founded in 2019. The company develops the Graphite surveillance platform, a mercenary spyware capability sold to government customers and used for covert access to mobile devices. Graphite has been associated with zero-click exploitation against both WhatsApp and Apple iMessage attack surfaces, including exploitation of CVE-2025-43200 and activity linked to CVE-2025-27363. The spyware is designed to compromise up-to-date smartphones without user interaction and enable extensive surveillance, including access to messages, emails, cameras, microphones, and location data. Paragon has been linked to targeting of journalists, civil society members, and activists, including multiple cases in Italy and additional victims in Europe. Publicly reported victimology includes Italian journalist Ciro Pellegrino, a prominent unnamed European journalist, and other Italian civil society figures and migrant-rights advocates who received notifications or showed forensic evidence of Graphite activity. WhatsApp attributed an active zero-click exploit campaign to Paragon and notified roughly 90 targeted accounts in early 2025. Forensic reporting has also tied Paragon activity to deployments in Australia, Canada, Cyprus, Denmark, Israel, Italy, and Singapore. Operationally, Paragon has been associated with sophisticated exploit development, zero-click initial access, covert surveillance, and post-compromise data collection. Reported delivery and exploitation methods include malicious content delivered through messaging platforms and exploitation of mobile operating system and application logic flaws. The company’s infrastructure and customer deployments have been mapped by researchers through certificate and server analysis, with evidence suggesting customer-operated deployments and government use. Italy publicly acknowledged being a Paragon customer, and Italian intelligence services confirmed operational deployment of Graphite. Paragon has faced sustained scrutiny because evidence of abuse has undermined claims that its business model prevents misuse against rights-respecting targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial spyware vendor behind the Graphite spyware platform. The content attributes infrastructure, a zero-click WhatsApp exploit, and targeting of journalists and civil society members in Italy to Paragon-linked operations, with suspected customer deployments in multiple countries.
Paragon is an Israeli company providing Graphite spyware to law enforcement, enabling access to encrypted messaging apps on compromised smartphones.
Paragon is associated with the use of Graphite spyware to conduct targeted surveillance against high-profile individuals, such as business executives.
Commercial spyware vendor accused by WhatsApp of targeting a small set of WhatsApp users with spyware; some attacks were later verified by Citizen Lab.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.