Loading story…
U.S. Immigration and Customs Enforcement confirmed to lawmakers that it bought and used Paragon Solutions spyware, including Graphite, in investigations tied to drug trafficking, fentanyl networks, and other organizations using encrypted communications. Acting ICE Director Todd Lyons said the deployment complied with constitutional requirements and the 2023 executive order restricting government use of commercial spyware, but House Democrats including Rep. Summer Lee said ICE had not provided enough documentation, safeguards, or oversight to justify such invasive surveillance. The disclosure followed the reactivation of ICE’s Paragon contract after an earlier suspension for review, and came amid wider controversy over reports linking Paragon spyware to targeting of journalists and activists.
The admission intensified concerns that U.S. policy may be softening toward the commercial spyware industry even as evidence mounts that these vendors are driving serious cyber abuse. Reporting and research cited growing alarm over the lifting of sanctions on Intellexa executives, new U.S.-linked ownership of NSO Group and Paragon, and the expanding role of brokers, resellers, and other intermediaries that help spyware vendors evade export controls and obscure supply chains. Analysts also noted that Google attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-backed groups in 2025, while lawmakers pressed for briefings on federal spyware use and U.S. investment in firms long associated with abuses involving Pegasus, Predator, and related surveillance tools.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Rep. Summer Lee asked the Commerce Department to brief Congress on federal use of commercial spyware and on U.S. investment in spyware vendors, citing concerns about the administration's posture toward the industry.
Three House Democrats—Summer Lee, Shontel Brown, and Yassamin Ansari—publicly criticized ICE's confirmed use of Paragon spyware, arguing the agency had not provided sufficient documentation, safeguards, or meaningful oversight.
ICE confirmed to lawmakers that it bought and used Paragon Solutions spyware in investigations involving drug trafficking and other targets using encrypted communications, saying the use complied with constitutional requirements and applicable policy restrictions.
The Atlantic Council published an issue brief examining how brokers, resellers, infrastructure providers, and other intermediaries enable proliferation in the offensive cyber capabilities and spyware market while obscuring accountability.
A recent OMB memo rescinded earlier Biden administration federal software supply chain guidance, making mechanisms such as secure software development attestations and SBOM requests optional rather than durable requirements.
On March 6, the U.S. government issued an executive order aimed at raising costs for cybercriminals through coordination, disruption, prosecutions, intelligence sharing, resilience measures, and diplomatic pressure on states that shelter such operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourceschneier.com
Open sourcecyberscoop.com
Open sourcetechcrunch.com
Open sourcedarkreading.com
Open sourceatlanticcouncil.org
Open sourcedarkreading.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. Immigration and Customs Enforcement (**ICE**) is exploring expanded access to commercially available data from online advertising and technology brokers to support investigations, issuing a **Request for Information (RFI)** to understand the availability of personal, financial, location, and health data and how it could be provided to federal investigative entities. The effort is framed as market research rather than a direct procurement, and follows an earlier RFI seeking open-source intelligence and social media data to improve targeting for ICE’s Enforcement and Removal Operations. Privacy and civil liberties advocates warn that purchasing brokered data can function as a workaround to traditional warrant requirements, and point to proposed legislation such as the **Fourth Amendment Is Not For Sale Act** as a potential constraint on government acquisition of data that would otherwise require judicial authorization. Reporting on ICE’s broader deportation and enforcement posture describes the agency’s reliance on multiple surveillance technologies to identify and track individuals, including **cell-site simulators** (also known as *stingrays* / **IMSI catchers**) that impersonate cellular towers to locate and potentially identify nearby phones. The coverage also highlights legal controversy around enforcement tactics, including allegations of warrantless home entry that legal experts argue conflicts with **Fourth Amendment** protections. Separately, European policymakers are described as reassessing dependence on U.S. technology amid geopolitical tensions and sanctions risk, but that discussion is not specific to ICE’s surveillance or data-broker acquisition activity.
Jun 29, 2026
Investigations into **NSO Group’s Pegasus spyware** showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the **Entity List**. Subsequent technical research from **Citizen Lab** found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—`LATENTIMAGE`, `FINDMYPWN`, and `PWNYOURHOME`—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s **Cy4Gate**, which was reported to market interception, intelligence analysis, and smartphone spyware products such as `Epeius` to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Aug 15, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026