Loading threat actor…
Paragon Solutions is an Israeli commercial spyware vendor associated with the Graphite surveillance platform. It has been linked to highly targeted intrusions against journalists and civil society members, including victims in Europe, using sophisticated zero-click exploitation on Apple devices and targeting through WhatsApp. Graphite has been described as capable of providing operators with extensive access to a victim device, including communications, stored data, sensors, and location information, consistent with advanced mobile spyware. Operations attributed to Paragon Solutions in 2025 involved zero-click delivery chains exploiting iOS vulnerabilities, including remote code execution triggered through crafted media shared via Apple ecosystem features, as well as campaigns affecting WhatsApp users. Confirmed victims included journalists, and broader targeting reportedly included civil society members. The actor’s tradecraft reflects advanced initial access and post-compromise surveillance capability, with emphasis on stealthy compromise of high-value individuals rather than broad criminal monetization. Paragon Solutions fits the profile of a commercial surveillance provider whose tooling is used for covert intelligence collection. Its known activity aligns with spyware operations focused on espionage-oriented monitoring of selected persons of interest rather than ransomware or disruptive attacks.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Israeli spyware company linked in the content to targeting journalists and civil society members in Europe using Graphite spyware delivered via zero-click attacks.
Paragon Solutions is a commercial surveillance vendor whose Graphite spyware platform uses zero-click vulnerabilities to compromise iOS devices, targeting journalists and high-profile individuals.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.