18 April 2023

Israeli spyware vendor QuaDream reportedly shuts down operations


Israeli spyware vendor QuaDream reportedly shuts down operations

Israel-based spyware maker QuaDream is allegedly shutting down its operations, according to Israeli news media reports.

Israeli newspaper Haaretz reported that QuaDream, mostly known as a developer of a zero-click iPhone hacking program, has called its employees in for a pre-termination hearing ahead of widespread layoffs.

The development comes less than a week after Microsoft and the internet watchdog Citizen Lab released two separate reports detailing an iOS zero-click exploit they dubbed “ENDOFDAYS” (Microsoft tracks it as “KingsPawn”), which has been used against journalists, opposition figures and advocacy organizations across at least 10 countries, including people in North America and Europe. The  exploit appears to abuse invisible iCloud calendar invitations sent from the spyware’s operator to victims.

Citizen Lab said it discovered operator locations for QuaDream systems, including servers for receiving data and deploying exploits, operated from Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates and Uzbekistan.

QuaDream is considered to be a low-level rival of the well-known and controversial Israeli spyware company NSO Group, the creator of the notorious Pegasus hacking tool.

QuaDream reportedly sells a platform they call REIGN to governments for law enforcement purposes. REIGN is a suite of exploits, malware, and infrastructure designed to exfiltrate data from mobile devices. Microsoft believes that the ENDOFDAYS/KingsPawn exploit is part of the REIGN platform.

Citing unnamed sources, Israeli news outlet Calcalist reported that following the media buzz the company's execs have decided to shutter operations, and are looking to sell off its intellectual property.

“According to sources, the company has been in a difficult situation for several months, and the research was the last nail in its coffin. The company hasn't been fully active for a while and it is believed that there are only two employees left in its offices whose job it is to look after the computers and other equipment,” Calcalist wrote.

Last month, US President Joe Biden signed an executive order that seeks to further ban the government from using any commercial spyware previously designed for “anti-democratic” uses or that poses a counterintelligence or security risk to the United States government.

Back to the list

Latest Posts

Cyber Security Week in Review: November 15, 2024

Cyber Security Week in Review: November 15, 2024

In brief: PAN-OS, D-Link RCE flaws exploited in the wild, the US confirms  Chinese hackers stole data from multiple telecom firms, and more.
15 November 2024
Russia-linked hackers exploit NTLM zero-day in cyberattack on Ukraine

Russia-linked hackers exploit NTLM zero-day in cyberattack on Ukraine

The attack involved a phishing email from a hacked Ukrainian government server, aimed at government personnel and academic institutions.
14 November 2024
US indicts two hackers behind Snowflake breach

US indicts two hackers behind Snowflake breach

The indictment links Moucka and Binns to breaches involving massive amounts of customer data stolen from Snowflake cloud accounts.
13 November 2024