Paragon
Paragon is spyware produced by an Israel-based company and described in the content as a commercial or mercenary surveillance tool intended for use on criminals. In January 2025, WhatsApp notified approximately 90 users in about two dozen countries that they had been targeted with Paragon spyware, including journalists and members of civil society; seven of the notified victims were in Italy. The content links Paragon to a broader pattern of targeted surveillance against activists and journalists in Italy, including Luca Casarini and Francesco Cancellato, whom WhatsApp told the spyware used against them had been made by Paragon. The company reportedly suspended or canceled its relationship with Italy in 2025 after allegations involving spyware use against a journalist and after the Italian government declined to assist an investigation. The content further states that Paragon spyware attacks exposed in 2025 targeted dozens of users through exploitation of WhatsApp and third-party component vulnerabilities. Mentioned indicators in the content are limited to victim notifications and contextual reporting; no specific technical IOCs such as domains, hashes, or filenames are provided.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
As commercial spyware relies on zero-day exploits for deployment, Insikt Group previously assessed that, in addition to posing serious human rights concerns, its misuse threatens the broader cyber ecosystem by enabling the proliferation of critical vulnerabilities.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial spyware implicated in targeting journalists and civil society members across multiple countries.
Commercial spyware referenced in the context of targeted surveillance and reported infections (e.g., in Italy).
Government-grade spyware described as military-grade and intended for use on criminals; it was reportedly used to target activists and a journalist in Italy.
Commercial spyware used to target users by exploiting zero-day vulnerabilities, particularly for surveillance and data exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.