The Graphite Controversy: Inside Israel’s Global Spyware Empire

Click to see the full-size image

Introduction
In March 2024 WhatsApp, which is owned by Meta, announced that 90 journalists and members of the public who use the popular messaging app had been targeted by spyware developed by Paragon Solutions, an Israeli company specializing in hacking tools. These journalists and civil society members were notified about the possible compromise of their devices’ security. It remains unclear who was behind the attack. Like other spyware vendors, Paragon’s hacking software is used by government clients, and WhatsApp stated it had been unable to identify which clients ordered the alleged attacks.

Experts have reported that the attack was of the zero-click type, meaning the targets did not need to click any malicious link for their devices to be infected. WhatsApp has declined to disclose the locations of the affected journalists and civil society members, including whether any of them were based in the United States. Three of the hacking victims were Italian journalists.

According to reports in The Guardian and Haaretz, Paragon has since severed ties with its clients in Italy, which reportedly included an intelligence agency and a law enforcement organization. Paragon exclusively works with governmental entities. The company’s flagship product, called Graphite, allows users full access to a target’s phone. Paragon claims that the software is intended for criminal investigations. The company is seen as a competitor to the NSO Group, maker of the Pegasus spyware.

Additionally, Israeli media have reported rumors of Paragon being sold to a U.S. company, which were recently denied by Israel’s Defense Minister following Donald Trump’s return to the White House.

Paragon Solutions
Paragon Solutions, founded in 2019 and currently employing 450 personnel, is a cyber company focused on offensive operations and security, utilizing digital intelligence to provide surveillance solutions for smartphones and the internet. The company claims to impose “strict ethical limitations” on itself, restricting data extraction from target devices solely to conversations within messaging apps. Paragon exclusively collaborates with law enforcement and intelligence agencies in what it defines as liberal democracies—a list that includes 39 countries.

As one of the two leading Israeli offensive cybersecurity firms alongside NSO, Paragon specializes in technologies classified as weapons and requires export approval from Israel’s Ministry of Defense. Unlike NSO, which faced international backlash and was blacklisted by the U.S. government for selling spyware to authoritarian regimes, Paragon was founded with a commitment to operate exclusively within democratic nations. This ethical positioning helped pave the way for future deals.

Founders and Key Figures
Among the founders of this cyber company is Ehud Barak, the former Prime Minister of Israel, underscoring Paragon’s prominence and distinct position among other firms in the industry. Some media outlets have even referred to the company as “Ehud Barak’s startup”, highlighting his influence in its establishment. According to the image below, the founders of this Israeli company are identified from right to left in the following order:

– Ehud Schneorson

Click to see the full-size image

After decades of service in the fields of signals intelligence (SIGINT), cyber operations, and special operations in the occupied territories, he was appointed as the head of Unit 8200, Israel’s elite military intelligence unit. According to Richard Silverstein, commanders in Israel’s Unit 8200are appointed in a highly specific and deliberate manner, alternating between a “khnun” (a Hebrew slang term for a “computer geek” or “tech nerd”) and an individual who rose through the ranks via combat roles. Ehud Schneorson is considered a khnun, whereas his predecessor, Nadav Zafrir, was a combat officer who served in Sayeret Matkal, Israel’s elite special forces unit. This alternating approach, blending technical expertise with combat experience, reflects the military’s effort to strike a balance between technological proficiency and operational capability.

– Ehud Barak

Click to see the full-size image

Ehud Barak, the former Prime Minister of Israel, has been a prominent figure in the country’s cybersecurity landscape. He played a significant role in the founding of Paragon Solutions, co-establishing the company alongside retired Brigadier General Ehud Schneorson. Barak’s involvement in Paragon has been substantial, and he also holds a stake in the company, underscoring his direct interest and influence in its operations.

– Idan Nurick

Click to see the full-size image

Idan Nurick is the CEO and co-founder of Paragon Solutions, with a background in medicine and an MBA. He has led several successful companies in the fields of cybersecurity and artificial intelligence, with a proven track record in team leadership, algorithm development, software engineering, and data analysis.
Nurick founded Cyber Hunters in 2018 and Paragon in 2019, serving as CEO of both. In 2020, he stepped away from Cyber Hunters to focus on Nash and Paragon. He currently serves as a director at Alameda Ventures and a senior executive at Bloomberg Capital. Prior to his current role, he also held a senior leadership position within Paragon. Nurick completed his studies at Tel Aviv University, earning both a master’s degree and an MBA.

– Liad Avraham
Liad Avraham, a resident of the occupied territories, is currently the co-founder and Chief Research Officer (CRO) at Paragon Solutions. He brings valuable experience from his previous roles at Paragon and in the Israel Defense Forces (IDF). Avraham holds a Bachelor’s degree in Computer Science from the Open University and possesses advanced skills in hacking iOS and Android operating systems. During his service in the IDF, he served as a team leader and cybersecurity researcher.

– Igor Bogdalov
Igor Bogdalov, a lesser-known figure among the founders pictured, is one of the co-founders and serves as Co-Chief Technology Officer (CTO) at Paragon. He earned his Master’s degree from Tel Aviv University.

Graphite
As previously mentioned, this spyware infiltrates devices electronically using a zero-click method, the operation of which is explained in detail below. Zero-click attacks are carried out secretly and do not require any direct user interaction or action. These attacks may seem simple because the attacker does not need to trick the user through phishing emails or clicking on malicious links. However, successfully executing these attacks is not easy. A critical aspect of performing a successful zero-click attack is sending a specially crafted piece of data to the target device via wireless communications such as Wi-Fi, NFC, Bluetooth, GSM, or LTE.
This data is designed to trigger a previously unknown or lesser-known vulnerability in the target device. The vulnerability may exist at the software or hardware level of the device. This data might exploit the vulnerability when processed by the device’s system on chip (SoC), but in most cases, the attacker designs the data to be interpreted by specific applications such as WhatsApp, Telegram, Skype, calling services, or even SMS. Therefore, the attacker carefully crafts this data to be interpretable by such applications. This data can take the following forms:
• MMS
• Voicemail
• Video conferencing sessions
• Text messages
• Authentication requests
• Network packets
• Phone calls

Conclusion
In light of the foregoing detailed discussion, it seems imperative to strengthen the cybersecurity outlook of intelligence agencies with respect to the newest infiltration techniques and the methods for preventing and countering cyberattacks; for failing to recognize the infection of a messaging‑service server application under normal conditions can constitute part of the persistent risk and harm posed by such attacks. Gaining familiarity with and access to the know‑how for producing this type of spyware may, in the future, foster scientific self‑sufficiency—both software‑ and network‑wise, and in certain cases hardware‑wise—within the country’s sensitive institutions as well as among technology firms operating in the realm of social networks. Another matter that acquires significant importance in the wake of these international disclosures is the investigation of the assassination cases of prominent Iranian figures and members of the resistance front in recent years; since the use of messaging apps and social networks—especially domestic platforms such as Eitaa and Baleh—has become commonplace, the hacking of individuals’ accounts grants access to every component of their smartphones, including microphones and geolocation; consequently, the relevant authorities must exercise heightened vigilance.

MORE ON THE TOPIC:

• Putin Discussed Syria, Iran In Phone Call With Netanyahu
• Iran Vows To Respond More Decisively To Any Attack By U.S. And Israel
• Houthis Vow To Attack All Ships Linked To Israel