18 April 2023

Israeli spyware vendor QuaDream reportedly shuts down operations


Israeli spyware vendor QuaDream reportedly shuts down operations

Israel-based spyware maker QuaDream is allegedly shutting down its operations, according to Israeli news media reports.

Israeli newspaper Haaretz reported that QuaDream, mostly known as a developer of a zero-click iPhone hacking program, has called its employees in for a pre-termination hearing ahead of widespread layoffs.

The development comes less than a week after Microsoft and the internet watchdog Citizen Lab released two separate reports detailing an iOS zero-click exploit they dubbed “ENDOFDAYS” (Microsoft tracks it as “KingsPawn”), which has been used against journalists, opposition figures and advocacy organizations across at least 10 countries, including people in North America and Europe. The  exploit appears to abuse invisible iCloud calendar invitations sent from the spyware’s operator to victims.

Citizen Lab said it discovered operator locations for QuaDream systems, including servers for receiving data and deploying exploits, operated from Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates and Uzbekistan.

QuaDream is considered to be a low-level rival of the well-known and controversial Israeli spyware company NSO Group, the creator of the notorious Pegasus hacking tool.

QuaDream reportedly sells a platform they call REIGN to governments for law enforcement purposes. REIGN is a suite of exploits, malware, and infrastructure designed to exfiltrate data from mobile devices. Microsoft believes that the ENDOFDAYS/KingsPawn exploit is part of the REIGN platform.

Citing unnamed sources, Israeli news outlet Calcalist reported that following the media buzz the company's execs have decided to shutter operations, and are looking to sell off its intellectual property.

“According to sources, the company has been in a difficult situation for several months, and the research was the last nail in its coffin. The company hasn't been fully active for a while and it is believed that there are only two employees left in its offices whose job it is to look after the computers and other equipment,” Calcalist wrote.

Last month, US President Joe Biden signed an executive order that seeks to further ban the government from using any commercial spyware previously designed for “anti-democratic” uses or that poses a counterintelligence or security risk to the United States government.

Back to the list

Latest Posts

What is Vulnerability Management? A Beginner's Guide

What is Vulnerability Management? A Beginner's Guide

In this article will try to cover basics of vulnerability management process and why it is important to every company.
11 September 2024
Cyber Security Week in Review: September 6, 2024

Cyber Security Week in Review: September 6, 2024

In brief: the US charges Russian GRU hackers for attacks on Ukraine, Apache, Cisco, Zyxel patch high-risk flaws, Google fixes Android zero-day, and more.
6 September 2024
Threat actors using MacroPack Red Team framework to deploy Brute Ratel, Havoc and PhantomCore

Threat actors using MacroPack Red Team framework to deploy Brute Ratel, Havoc and PhantomCore

Some of the documents appeared to be part of legitimate Red Team exercises, while other were intended for malicious purposes.
5 September 2024