Israeli spyware vendor QuaDream reportedly shuts down operations

Israeli spyware vendor QuaDream reportedly shuts down operations

Israel-based spyware maker QuaDream is allegedly shutting down its operations, according to Israeli news media reports.

Israeli newspaper Haaretz reported that QuaDream, mostly known as a developer of a zero-click iPhone hacking program, has called its employees in for a pre-termination hearing ahead of widespread layoffs.

The development comes less than a week after Microsoft and the internet watchdog Citizen Lab released two separate reports detailing an iOS zero-click exploit they dubbed “ENDOFDAYS” (Microsoft tracks it as “KingsPawn”), which has been used against journalists, opposition figures and advocacy organizations across at least 10 countries, including people in North America and Europe. The  exploit appears to abuse invisible iCloud calendar invitations sent from the spyware’s operator to victims.

Citizen Lab said it discovered operator locations for QuaDream systems, including servers for receiving data and deploying exploits, operated from Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates and Uzbekistan.

QuaDream is considered to be a low-level rival of the well-known and controversial Israeli spyware company NSO Group, the creator of the notorious Pegasus hacking tool.

QuaDream reportedly sells a platform they call REIGN to governments for law enforcement purposes. REIGN is a suite of exploits, malware, and infrastructure designed to exfiltrate data from mobile devices. Microsoft believes that the ENDOFDAYS/KingsPawn exploit is part of the REIGN platform.

Citing unnamed sources, Israeli news outlet Calcalist reported that following the media buzz the company's execs have decided to shutter operations, and are looking to sell off its intellectual property.

“According to sources, the company has been in a difficult situation for several months, and the research was the last nail in its coffin. The company hasn't been fully active for a while and it is believed that there are only two employees left in its offices whose job it is to look after the computers and other equipment,” Calcalist wrote.

Last month, US President Joe Biden signed an executive order that seeks to further ban the government from using any commercial spyware previously designed for “anti-democratic” uses or that poses a counterintelligence or security risk to the United States government.

Back to the list

Latest Posts

UMMC pharmacist installed malware on hundreds hospital computers to spy on doctors

UMMC pharmacist installed malware on hundreds hospital computers to spy on doctors

His alleged actions included watching the women undress, breastfeed, and engage in private activities such as intimate acts with their husbands.
8 April 2025
Dark web leak site of Everest ransomware gang hacked and defaced

Dark web leak site of Everest ransomware gang hacked and defaced

Experts speculate that the Everest gang’s use of a WordPress template for their leak site might have played a key role in the breach.
8 April 2025
Threat actors exploiting recent CrushFTP auth bypass flaw for persistent access

Threat actors exploiting recent CrushFTP auth bypass flaw for persistent access

The vulnerability, now tracked as CVE-2025-31161, allows attackers to bypass authentication and gain unauthorized access to targeted systems.
8 April 2025