QuaDream
Israeli spyware firm (Reign) linked by Citizen Lab and Microsoft to hacking of journalists and opposition figures; reported shut in 2023
| QuaDream
| |
|---|---|
| Type | Private (reported shut down, 2023) |
| Founder(s) | Ilan Dabelstein, Guy Geva, Nimrod Rinsky |
| Headquarters | Israel |
| Industry | Spyware / offensive cyber |
QuaDream was an Israeli company that developed and sold offensive hacking tools to government clients, marketed under the name "Reign". Citizen Lab described it in April 2023 as a company that "specialises in the development and sale of advanced digital offensive technology to government clients" whose spyware, "like NSO Group's Pegasus spyware, reportedly utilises zero-click exploits to hack into target devices".[1] Haaretz reported in May 2023 that the firm had shut down.[2]
Founders and links to Israeli intelligence
Citizen Lab named the three founders as Ilan Dabelstein, Guy Geva and Nimrod Rinsky. It described Dabelstein as "a former Israeli military official" who was a co-founder, major shareholder and board member, and said Israeli registration documents of February 2021 listed him as CEO. It reported, citing Reuters, that Geva and Rinsky "both previously worked for NSO Group".[1]
Citizen Lab added that QuaDream had a partnership with a Cyprus-registered company, InReach, with which it was in a legal dispute, and that "numerous key individuals associated with both companies have prior connections with another surveillance vendor, Verint, as well as Israeli intelligence agencies".[1]
Victims and customers
Microsoft Threat Intelligence said it assessed "with high confidence" that a threat group it tracked as DEV-0196 was linked to QuaDream, and called the iOS malware it analysed "KingsPawn". Microsoft said QuaDream "reportedly sells a platform they call REIGN to governments for law enforcement purposes".[3]
Working from samples shared by Microsoft, Citizen Lab identified "at least five civil society victims" in North America, Central Asia, Southeast Asia, Europe and the Middle East, including "journalists, political opposition figures, and an NGO worker". It reported a suspected zero-click exploit, which it called ENDOFDAYS, that used "invisible iCloud calendar invitations" against iOS 14. Internet scanning led it to systems operated from Bulgaria, the Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, the United Arab Emirates and Uzbekistan.[1]
Closure
Haaretz described QuaDream as "a boutique Israeli spyware maker that once boasted clients in Saudi Arabia" and "long considered the biggest local threat to NSO Group", and reported in its headline that Israel had "torpedoed" a spyware deal with Morocco before the firm shut down.[2]
See also
- NSO Group
- Candiru
- Intellexa
- Verint
- Cyber and tech firms founded by ex Unit 8200 or occupation forces veterans
Notes
- ↑ 1.0 1.1 1.2 1.3 Bill Marczak, John Scott-Railton, Astrid Perry, Noura Aljizawi, Siena Anstis, Zoe Panday, Emma Lyon, Bahr Abdul Razzak and Ron Deibert, Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers, Citizen Lab, 11 April 2023.
- ↑ 2.0 2.1 Omer Benjakob and Jurre van Bergen, Israel Torpedoed Morocco Spyware Deal - and NSO Competitor QuaDream Shut Down, Haaretz, 23 May 2023.
- ↑ Microsoft Threat Intelligence, DEV-0196: QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia, Microsoft Security Blog, 11 April 2023.