Six additional countries identified as suspected Paragon spyware customers | CyberScoop<\/title> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/six-countries-suspected-paragon-spyware-customers\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Six additional countries identified as suspected Paragon spyware customers\"> <meta property=\"og:description\" content=\"Researchers found suspected Graphite deployments in Australia, Canada, Cyprus, Denmark, Israel and Singapore.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/six-countries-suspected-paragon-spyware-customers\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-03-19T15:40:57+00:00\"> <meta property=\"article:modified_time\" content=\"2025-03-19T15:41:00+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1097\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1739294329g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1740508126g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1740691656g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=a815169637cf454b7376\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83913\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83913\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fsix-countries-suspected-paragon-spyware-customers%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fsix-countries-suspected-paragon-spyware-customers%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83913 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/six-countries-suspected-paragon-spyware-customers\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"27.282663316583\">\n<div class=\"single-article__header-content\" readability=\"38.186666666667\">\n<p> Researchers found suspected Graphite deployments in Australia, Canada, Cyprus, Denmark, Israel and Singapore. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83913\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"366\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers.jpg?resize=640%2C366&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=300,171 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=768,439 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=1024,585 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=1536,878 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=600,343 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=294,168 294w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=590,337 590w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=1181,675 1181w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-2.jpg?resize=1475,843 1475w\" sizes=\"(max-width: 1181px) 100vw, 1181px\"><figcaption> rob dobi, Getty Images <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"36.887133182844\"><body readability=\"76.192954617582\"><\/p>\n<p>Researchers have identified suspected government customers of spyware company Paragon Solutions in six more countries that hadn\u2019t previously been publicly identified, according to a report published Wednesday.<\/p>\n<p>The University of Toronto\u2019s Citizen Lab said it mapped the infrastructure of Paragon\u2019s Graphite tool after a tip from a collaborator, and found a subset of suspected Paragon deployments linked to Australia, Canada, Cyprus, Denmark, Israel and Singapore. It also found potential links between Paragon and the Ontario Provisional Police.<\/p>\n<p><a href=\"https:\/\/citizenlab.ca\/2025\/03\/a-first-look-at-paragons-proliferating-spyware-operations\/\">The report<\/a> also shines additional light on Paragon infections of activists and others in Italy, <a href=\"https:\/\/cyberscoop.com\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society\/\">revealed in January<\/a>. Citizen Lab concluded from its research that Paragon, a relatively new entrant in the spyware marketplace, might not have done enough to prevent abuses despite its marketing stance.<\/p>\n<p>\u201cOverall, the cases described in this report suggest that Paragon\u2019s claims of having found an abuse-proof business model may not hold up to scrutiny,\u201d the report reads. \u201cWe acknowledge that this report does not seek to cover the totality of Paragon cases, but rather a set of cases where targets have chosen to come forward at this time and in our report.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cHowever, the pattern in these cases challenges Paragon\u2019s marketing approach which has claimed that the company would only sell to clients that \u2018abide by international norms and respect fundamental rights and freedoms,\u2019\u201d it continued.<\/p>\n<p>The six countries and the Ontario police service did not immediately respond to requests for comment.<\/p>\n<p>A Paragon official responded to the report by saying, in part, that it keeps clients confidential and may be legally restricted from speaking on national security and foreign policy matters.<\/p>\n<p>\u201cThe brief summary of the report you sent includes several inaccuracies, but without additional details we cannot be more specific or provide comment for the record,\u201d wrote John Fleming, executive vice chairman of Paragon. He didn\u2019t elaborate on the inaccuracies when asked to do so by Citizen Lab.<\/p>\n<p>Citizen Lab provided additional details in its report about Italian Paragon activity, including about a potential cluster targeting sea rescue operations for migrants in the Sahel and Sub-Saharan regions and the targeting of a personal friend of Pope Francis.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>David Yambio, an Italian activist who is founder of the organization Refugees in Libya and whose phone Citizen Lab analyzed, said he was targeted by spyware during a period when he was sharing confidential information about torture victims with the International Criminal Court, <a href=\"https:\/\/www.theguardian.com\/world\/2025\/mar\/19\/italian-activist-david-yambio-alerts-icc-spyware-attack\">The Guardian reported<\/a>.<\/p>\n<p><a href=\"https:\/\/apnews.com\/article\/italy-israeli-spyware-paragon-whatsapp-meta-21803e69ec6ce5802ea5759a8f4daa4d\">Italy has denied<\/a> that it used spyware on journalists and activists.<\/p>\n<p>Citizen Lab\u2019s report worsens a \u201cdigital surveillance crisis\u201d in Europe, said Donncha \u00d3 Cearbhaill, Head of Amnesty International\u2019s Security Lab.<\/p>\n<p>\u201cOf particular concern is the targeting of sea rescue organizations engaged in life-saving activities in the Mediterranean,\u201d <a href=\"https:\/\/www.amnesty.org\/en\/latest\/news\/2025\/03\/europe-paragon-attacks-highlight-europes-growing-spyware-crisis\/\">he said<\/a>. \u201cThis adds a dangerous new digital threat to organizations already grappling with legal threats, obstruction and criminalization in Italy.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/03\/six-additional-countries-identified-as-suspected-paragon-spyware-customers-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/six-countries-suspected-paragon-spyware-customers\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Six additional countries identified as suspected Paragon spyware customers |<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3035,2785,2786,2045,3927,1367,514,3928,3645,268,2835,482,288],"tags":[3037,2789,2790,2050,3929,1368,518,3930,3647,274,2838,484,294],"class_list":["post-7458","post","type-post","status-publish","format-standard","hentry","category-amnesty-international","category-australia","category-canada","category-citizen-lab","category-cyprus","category-denmark","category-israel","category-italy","category-paragon","category-privacy","category-singapore","category-spyware","category-threats","tag-amnesty-international","tag-australia","tag-canada","tag-citizen-lab","tag-cyprus","tag-denmark","tag-israel","tag-italy","tag-paragon","tag-privacy","tag-singapore","tag-spyware","tag-threats"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/amnesty-international\/\" rel=\"category tag\">Amnesty International<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/australia\/\" rel=\"category tag\">Australia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/canada\/\" rel=\"category tag\">Canada<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/citizen-lab\/\" rel=\"category tag\">Citizen Lab<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyprus\/\" rel=\"category tag\">Cyprus<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/denmark\/\" rel=\"category tag\">Denmark<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/israel\/\" rel=\"category tag\">Israel<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/italy\/\" rel=\"category tag\">Italy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/paragon\/\" rel=\"category tag\">Paragon<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/privacy\/\" rel=\"category tag\">Privacy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/singapore\/\" rel=\"category tag\">Singapore<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/spyware\/\" rel=\"category tag\">spyware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a>","tag_info":"Threats","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7458","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7458"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7458\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7458"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7458"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7458"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7458,"date":"2025-03-19T10:40:57","date_gmt":"2025-03-19T15:40:57","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83913"},"modified":"2025-03-19T10:40:57","modified_gmt":"2025-03-19T15:40:57","slug":"six-additional-countries-identified-as-suspected-paragon-spyware-customers","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/03\/19\/six-additional-countries-identified-as-suspected-paragon-spyware-customers\/","title":{"rendered":"Six additional countries identified as suspected Paragon spyware customers"},"content":{"rendered":"