Commercial spyware & phone-forensics vendors (beyond NSO/Gamma/Intellexa)

Batch 4 of the threat-actor catalog - the commercial surveillance industry, split into two adjacent-but-distinct markets.

Remote spyware (covert zero-click implants)

• Paragon Solutions (Israel) - "Graphite," marketed as the ethical alternative; Citizen Lab (2025) documented WhatsApp targeting of journalists in Italy ("Paragate"), contradicting the framing. Acquired by US-based AE Industrial Partners (~2024) with a paused ~$2M ICE/HSI contract - the "US-friendly spyware" play.
• QuaDream (Israel) - "Reign," an iOS zero-click Pegasus rival; exposed by Citizen Lab + Microsoft (2023) and shut down shortly after.
• Circles - SS7-based phone-location/interception (no infection needed), commonly owned with NSO under the Francisco Partners era; Citizen Lab (2020) found 25 government customers.
• Variston (Spain) - the "Heliconia" browser/Windows exploitation framework; exposed by Google TAG (2022-23), wound down ~2024 - the EU exploit-broker branch.
• Cognyte (ex-Verint, Israel) - named in Meta's 2021 "surveillance-for-hire" report (with Cobwebs, Black Cube, BellTroX) - the social-media-surveillance tier.

Phone-forensics extraction (physical-access unlocking of seized devices)

• Cellebrite (Israel; NASDAQ: CLBT) - UFED, the dominant seized-phone extraction tool for police/agencies worldwide (the San Bernardino iPhone debate; also authoritarian misuse).
• GrayKey (Grayshift, merged with Magnet Forensics 2023) - US-centric iPhone unlocking rival.
• Heavily procured by US federal + local law enforcement (FBI, ICE/HSI, police) - lawful-access technology whose oversight/misuse is the live civil-liberties debate.

The taxonomy distinction (kept deliberately)

Extraction tools require physical custody + (usually) legal process; remote spyware covertly infects a target's live phone. Both sell government surveillance capability, but they are legally and technically different - so this block keeps extraction on its own sub-hub rather than conflating it with covert spyware.

Honest limits

"Ethical spyware" is vendor framing that documented targeting contradicts. Targeting findings come from Citizen Lab / Google TAG / Meta - well-corroborated but from parties (graded). Ownership chains (Francisco Partners, AE Industrial, Sun Corp) are as-reported. Much of the industry clusters in Israel (Unit 8200 alumni pipeline).

Sources: Citizen Lab (Circles 2020; QuaDream 2023; Paragon/Graphite 2025); Google TAG (Variston); Meta surveillance-for-hire (2021); Cellebrite/Magnet filings + procurement; US Entity List/Treasury. Cross-refs: Commercial_Spyware_Market, NSO_Group, Citizen_Lab, Meta, US_Government, Israel, Malware_Lineage.

← Research index · structured data: spec-spyware-vendor-catalog.json · spec-spyware-vendor-catalog.md