Reign
Reign is mercenary spyware developed by Israeli spyware vendor QuaDream (also referred to as Quadream in the provided content). It is described as targeted spyware used against Apple iOS devices and is mentioned alongside Pegasus and Predator as a notable mobile spyware threat. The content links Reign to QuaDream’s reseller InReach Technologies Limited, which was reportedly established in 2017 to promote QuaDream products such as Reign outside Israel and to bypass EU dual-use export restrictions. High-confidence details in the provided material are limited: Reign is associated with QuaDream, is used in targeted intrusions against iOS devices, and is sufficiently established to be included in forensic detection efforts such as the iShutdown method for identifying signs of spyware on Apple devices. No specific technical indicators of compromise, exploit chain details, or victim sectors are provided in the content beyond its classification as targeted iOS spyware.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
With system access, intermediaries are able to collect, exploit, extract, intercept, retrieve, alter, delete, or transmit content.
Intermediaries are fundamentally different than other entities that operate within the marketplace for OCC. Intermediaries are largely found as partners within the OCC supply chain, complimenting product development through vulnerability research to complete exploit chains or as auxiliary support during technology deployment.
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Spyware product from Quadream discussed in the context of reseller-facilitated international sales.
Mercenary spyware referenced as another spyware family excluded during forensic analysis of the iPhone case.
Referenced as an example of targeted spyware infecting iOS devices.
Reign is a commercial spyware developed by QuaDream, used to compromise iOS devices for surveillance and data exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.