Loading story…
An international initiative known as the Pall Mall Process is moving from government-focused norms to developing opt-in guidelines for the commercial cyber intrusion/spyware industry, amid debate over how to define the market and constrain abuse without eliminating tools used for legitimate purposes such as law enforcement. Participants have been grappling with core design questions including who the rules should apply to, how to draw boundaries between legitimate security research and illicit intrusion activity, and whether the scope should include adjacent capabilities such as reconnaissance tooling.
At a discussion held under Chatham House rules alongside Washington, D.C.-area events, stakeholders from government, industry, and civil society weighed how to incentivize participation and measure compliance, and how to handle vendors with a “checkered past.” Commentary around the effort emphasized that voluntary, non-binding standards may have limited impact without stronger state action, pointing to existing government levers already used to shape the market—such as Entity List designations, financial sanctions, and visa restrictions targeting actors involved in the misuse of commercial spyware.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Paragon Solutions was later acquired by AE Industrial Partners in a deal reportedly valued at $500 million. The acquisition underscored the continued commercial viability of spyware vendors amid international debate over regulation and accountability.
After the Italy-related controversy, Paragon Solutions later received a contract from US Immigration and Customs Enforcement. The development was highlighted in discussion of how governments continue to engage commercial spyware vendors despite abuse concerns.
Paragon Solutions reportedly ended its relationship with the Italian government after its spyware was allegedly used in Italy to target journalists and activists. The case was cited as an example of a spyware vendor trying to present itself as compliant despite controversy over prior use.
At DistrictCon in Washington, D.C., government, industry, and civil society representatives debated what the voluntary standards should cover, including reconnaissance tools, customer due diligence, and possible vendor kill switches. They also discussed how procurement pressure and other incentives might encourage compliance without driving vendors toward non-participating governments.
Participants in the Pall Mall Process moved from government-use rules toward drafting voluntary standards for commercial cyber intrusion vendors. The effort is intended to shape expectations for vendor behavior even though the guidelines would be non-binding.
The international Pall Mall Process initially focused on developing a voluntary code of conduct for how governments should use commercial cyber intrusion tools. This first phase preceded later work on standards aimed directly at the commercial hacking industry.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. Immigration and Customs Enforcement confirmed to lawmakers that it bought and used Paragon Solutions spyware, including **Graphite**, in investigations tied to drug trafficking, fentanyl networks, and other organizations using encrypted communications. Acting ICE Director Todd Lyons said the deployment complied with constitutional requirements and the 2023 executive order restricting government use of commercial spyware, but House Democrats including **Rep. Summer Lee** said ICE had not provided enough documentation, safeguards, or oversight to justify such invasive surveillance. The disclosure followed the reactivation of ICE’s Paragon contract after an earlier suspension for review, and came amid wider controversy over reports linking Paragon spyware to targeting of journalists and activists. The admission intensified concerns that U.S. policy may be softening toward the commercial spyware industry even as evidence mounts that these vendors are driving serious cyber abuse. Reporting and research cited growing alarm over the lifting of sanctions on Intellexa executives, new U.S.-linked ownership of **NSO Group** and Paragon, and the expanding role of brokers, resellers, and other intermediaries that help spyware vendors evade export controls and obscure supply chains. Analysts also noted that Google attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-backed groups in 2025, while lawmakers pressed for briefings on federal spyware use and U.S. investment in firms long associated with abuses involving **Pegasus**, **Predator**, and related surveillance tools.
Jun 29, 2026
Members of the European Parliament (MEPs) have raised urgent concerns regarding the allocation of European Union funds to companies that develop commercial spyware. A coalition of 39 MEPs has formally demanded explanations from senior European Commission officials after investigative reports revealed that millions of euros in EU subsidies have been directed to spyware vendors. These companies, including Intellexa, Cy4Gate, Verint, and Cognyte, have been linked to unlawful surveillance activities targeting journalists, human rights defenders, and political figures both within the EU and in countries with poor human rights records. The MEPs' letter specifically references findings from the investigative outlet Follow the Money, which documented how state-owned entities and EU programs, such as the European Defense Fund and Horizon 2020, have provided substantial financial support to these firms. For instance, Cy4Gate reportedly received at least €3.8 million from EU sources over a four-year period ending in 2024, with the company claiming the funds were for research and development in cybersecurity technologies for both civilian and defense applications. Additional funding examples include €1.3 million from Spain’s public Centre for the Development Of Industrial Technology to Mollitiam Industries, and €1.74 million from Horizon 2020 to projects involving Innova, a supplier of surveillance tools to Italian prosecutors. The European Regional Development Fund and the European Social Fund also contributed to Innova and Movia, the latter developing the Spider spyware. The MEPs argue that these funding practices raise serious questions about the governance, transparency, and accountability of EU financial mechanisms. They highlight the contradiction between the EU’s stated commitment to democracy and human rights and its indirect support for technologies that undermine these values. The letter was addressed to key European Commission officials responsible for technology, democracy, and budget oversight, demanding a thorough review and immediate action to prevent further subsidization of spyware companies. The issue has gained urgency as several MEPs have themselves been targeted by mercenary spyware, prompting the European Parliament to implement proactive device checks for its members. The controversy follows a series of scandals in countries such as Italy, Greece, Poland, Hungary, and Spain, where spyware has been used in politically sensitive surveillance operations. The MEPs also referenced recommendations from the PEGA inquiry, which previously called for stricter controls on surveillance technology. The ongoing revelations have intensified calls for greater oversight and reform of EU funding programs to ensure they do not enable the erosion of fundamental rights. The situation underscores the complex intersection of technology development, public funding, and civil liberties within the European Union. The European Commission is now under significant pressure to clarify its position and implement safeguards against the misuse of EU resources. The debate is expected to continue as more details emerge about the extent of EU involvement in supporting the spyware industry. The outcome of this inquiry could have far-reaching implications for EU policy on technology, security, and human rights.
Jun 29, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026