Unmasking Graphite: How Mercenary Spyware Targeted Journalists via Apple's iOS

1. Introduction: The Alarming Rise of Zero-Click Spyware

The digital threat landscape is undergoing a profound transformation, marked by the escalating sophistication of cyberattacks. At the forefront of this evolution is the emergence of highly advanced mercenary spyware – powerful surveillance tools developed and sold by private companies, often to state actors or other well-resourced entities. Paragon's Graphite spyware stands as a stark example of this concerning trend, representing a new frontier in digital espionage.

What makes these tools particularly insidious is their reliance on "zero-click" attacks. Unlike traditional cyber threats that require user interaction, such as clicking a malicious link or opening an infected attachment, zero-click attacks compromise devices silently, without any visible action from the target. This inherent stealth renders them exceptionally difficult for individuals to detect, underscoring the advanced capabilities of the threat actors and the inherent vulnerabilities that can exist even within seemingly secure platforms.

In this opaque and rapidly evolving environment, independent cybersecurity research organizations play an indispensable role. Entities like Citizen Lab are at the vanguard of uncovering, analyzing, and publicly reporting on these clandestine operations. Their meticulous investigations provide vital intelligence that is often instrumental in driving platform-level mitigations and informing the public. For instance, Citizen Lab has been crucial in discovering and reporting on the Paragon Graphite spyware, identifying its targets, and detailing the forensic evidence and technical aspects of its capabilities and methods.1 It is notable that Apple's public advisory regarding a critical vulnerability coincided directly with a report from Citizen Lab, which detailed how this specific vulnerability, CVE-2025-43200, was exploited in zero-click attacks to deploy Paragon spyware on the iPhones of European journalists. This demonstrates the critical, albeit sometimes indirect, synergy between platform vendors and independent researchers in addressing high-stakes threats.

The repeated identification of "advanced spyware" and "sophisticated iMessage zero-click attacks" points to a significant escalation in the sophistication of cyber threats. The very nature of "zero-click" attacks means they bypass common user-centric defense mechanisms, such as vigilance against suspicious links. Developing and deploying such attacks demands substantial financial investment, highly specialized technical expertise, and access to previously unknown vulnerabilities (zero-days). This suggests that the entities behind these attacks are not merely opportunistic but are well-funded and highly motivated, often indicative of state-sponsored or state-aligned actors. Furthermore, the fact that these attacks are "not visible to the target" and that individuals are only notified after the fact that they "had been targeted" reveals a profound asymmetry of information and power. Targets remain completely unaware of their compromise until an external entity, such as Apple's internal detection systems or Citizen Lab's forensic analysis, intervenes. This reality deeply erodes fundamental trust in personal devices and digital communication, implying that even a seemingly secure device cannot guarantee absolute protection against such advanced, stealthy intrusions. This has far-reaching implications for individual privacy, freedom of expression, and the overall integrity of the digital ecosystem.

2. The Anatomy of a Sophisticated Attack: CVE-2025-43200 Explained

The Paragon Graphite spyware leveraged a specific and critical flaw within Apple's Messages application, identified as CVE-2025-43200. This vulnerability was a "logic issue" that could be triggered when a maliciously crafted photo or video was processed after being shared via an iCloud Link. This highlights a fundamental flaw in how the system handled certain media types, allowing an attacker to execute code without user interaction.

The nature of this vulnerability facilitated a "zero-click" exploitation mechanism. The mere receipt and subsequent processing of the malicious content, without any active engagement from the user, was sufficient for the spyware to be deployed onto the target's device. This underscores the exceptional stealth and effectiveness of the attack vector, making it nearly impossible for targets to detect the compromise as it occurred.

Citizen Lab's forensic analysis played a pivotal role in attributing these compromises to Paragon's Graphite spyware with high confidence. Their methodology involved identifying specific indicators within device logs, such as a series of requests to a server that matched their previously published "Fingerprint P1". This fingerprint is uniquely linked to Graphite spyware. Further investigation led to the identification of the specific Graphite spyware server contacted by one of the targeted devices:

https://46.183.184[.]91/.1 This server, rented from VPS provider EDIS Global, remained online and matched Fingerprint P1 until at least April 12, 2025.

A crucial finding in Citizen Lab's investigation was the discovery of the same ATTACKER1 iMessage account in the device logs of both the prominent European journalist and Italian journalist Ciro Pellegrino. Based on their extensive experience, Citizen Lab posits that each customer of a mercenary spyware company typically maintains its own dedicated infrastructure. This observation led them to conclude that the

ATTACKER1 account was used exclusively by a single Graphite customer or operator, directly implying that the same entity was responsible for targeting both individuals.This finding provides a direct and compelling link between the two separate attacks.

The fact that the vulnerability was a "logic issue" within Apple's Messages app, a core component of the iOS operating system, is highly significant. This indicates that the flaw was not introduced by a third-party application or through user misconfiguration, but was inherent to the platform's own code. This reality demonstrates that even highly secure, closed-ecosystem platforms developed by companies with vast resources, such as Apple, are susceptible to sophisticated, zero-day vulnerabilities. This underscores a fundamental truth about complex software systems: they will invariably contain vulnerabilities, regardless of the developer's intent or security efforts. This necessitates a continuous, proactive approach to security by vendors, including rigorous internal auditing, robust bug bounty programs, and rapid patching, as the very software supply chain can itself be a point of failure.

Furthermore, Citizen Lab's inference that the ATTACKER1 account was used "exclusively by a single Graphite customer/operator" is a key observation. This strongly suggests that mercenary spyware companies like Paragon operate on a commercial, "for-hire" model, selling their advanced tools and associated infrastructure to various clients. This commercialization creates a distinct separation between the developer/operator of the spyware and the ultimate customer who commissions the surveillance. This separation significantly complicates efforts to achieve accountability. The mercenary company provides the means, but the customer dictates the target and purpose. This model allows customers, potentially including state or non-state actors, to conduct sophisticated surveillance while maintaining a degree of plausible deniability, making legal, diplomatic, and punitive actions against the perpetrators considerably more challenging. It points to a burgeoning and largely unregulated global market for these powerful digital weapons.

3. Journalists Under Siege: Confirmed Targets and the Fanpage.it Cluster

The investigation revealed specific and concerning instances of confirmed targeting. A prominent European journalist, who requested anonymity, and Italian journalist Ciro Pellegrino were both confirmed targets of Paragon’s Graphite mercenary spyware. Forensic analysis of their Apple devices indicated compromise in January and early February 2025, while the devices were running iOS 18.2.1.1

A critical indicator in these cases was Apple's direct notification to these individuals on April 29, 2025, informing them that they had been targeted with advanced spyware. This action highlights Apple's internal detection capabilities and its commitment to informing users about such sophisticated attacks, representing a crucial step towards transparency in a domain often shrouded in secrecy.

The pattern of targeting observed at Fanpage.it, a prominent Italian news organization, is particularly alarming. Ciro Pellegrino, a journalist and head of the Naples newsroom at Fanpage.it, was a confirmed target. Furthermore, his colleague, Francesco Cancellato, also received a WhatsApp notification in January 2025 about being targeted with Paragon’s Graphite spyware on his Android device. While forensic analysis of Mr. Cancellato's device is ongoing and has not yet confirmed a successful infection due to limitations in Android logs, the identification of multiple journalists from the same news outlet being targeted strongly suggests a deliberate and concerted effort to surveil or compromise this specific organization.

Citizen Lab’s forensic analyses of these attacks and Paragon’s capabilities on both iOS and Android are ongoing.The scope of the issue extends beyond these cases, with Citizen Lab providing a table summarizing confirmed Paragon targeting cases in Italy, including individuals like Luca Casarini and Giuseppe Caccia. They also note that David Yambio and Father Mattia Ferrari, though connected to these cases, have not yet been confirmed as Paragon mercenary spyware targets.

The following table summarizes the confirmed Paragon spyware targeting cases in Italy as identified by Citizen Lab:

Confirmed Paragon Spyware Targeting Cases in Italy (as identified by Citizen Lab)

The explicit identification of "journalists" as confirmed targets and the strong evidence of a "Fanpage.it Cluster" point to a strategic pattern. Journalists and news organizations are vital information gatekeepers in democratic societies, playing a crucial role in investigative reporting, disseminating information, holding power accountable, and shaping public discourse. Therefore, targeting these individuals and entities with sophisticated, invisible spyware is not a random act. It is a strategic move likely aimed at intelligence gathering, identifying confidential sources, disrupting ongoing investigations, or intimidating and ultimately silencing critical voices. This creates a profound "chilling effect" on press freedom, making journalists hesitant to pursue sensitive stories and ultimately undermining the public's right to know.

Furthermore, the repeated use of the term "mercenary spyware" implies that private companies are developing and selling these tools, and the "customer/operator" model suggests that these tools are then utilized by various clients, who could be state actors, intelligence agencies, or even private entities. The observation that "there has been no explanation regarding who is responsible for spying on them" and the explicit questioning of "the legal authority, if any, under which this targeting occurred" highlight a critical challenge in modern cyber espionage. The difficulty in definitively attributing attacks to a specific state or non-state actor, especially when private companies act as intermediaries, allows perpetrators to operate with a degree of impunity. This obfuscation makes it difficult to apply international law, impose sanctions, or hold responsible parties accountable. This signifies a new era where advanced surveillance capabilities are no longer solely the domain of national intelligence agencies but are commercially available, complicating geopolitical responses and accountability efforts.

4. Apples Response: Patching the Vulnerability and Ongoing Vigilance

Apple demonstrated a responsible, albeit delayed in public disclosure, response by swiftly addressing the identified vulnerability. The flaw, CVE-2025-43200, was mitigated in iOS 18.3.1.1 While the patch itself was released in February, the public advisory was updated to include details about its exploitation only recently, coinciding with Citizen Lab's comprehensive report.

The significance of Apple's patch cannot be overstated. It directly mitigates the specific zero-click vulnerability that Paragon Graphite exploited, thereby enhancing the security posture of Apple devices against such highly invasive digital threats.This action is crucial for protecting millions of users who might otherwise remain vulnerable to similar sophisticated attacks.

For users, the importance of keeping devices and software updated to the latest versions is paramount. Security patches are only effective if they are applied. This serves as a vital, actionable takeaway for all digital citizens, reinforcing the need for proactive personal cybersecurity measures.

However, while this specific vulnerability has been addressed, it is crucial to recognize that the broader threat from mercenary spyware remains persistent and continuously evolving. Citizen Lab's ongoing analyses of Paragon's capabilities on both iOS and Android underscore that this is a continuous cat-and-mouse game between attackers and defenders.

This sequence of events—a sophisticated zero-click vulnerability being exploited, followed by Apple's rapid patching, yet with Citizen Lab's analysis of the threat capabilities remaining "ongoing"—illustrates the relentless, adversarial dynamic inherent in cybersecurity. As defenders identify and patch known vulnerabilities, well-resourced attackers, particularly mercenary spyware vendors, are perpetually seeking or developing new zero-day exploits. This implies that security is not a static state achieved by a single patch, but an ongoing process demanding continuous investment in research, rapid response mechanisms, and adaptive strategies from platform providers, security researchers, and even end-users. The cycle of discovery, exploitation, and mitigation is relentless and requires constant vigilance.

Moreover, the fact that Apple "notified a select group of iOS users" and "confirmed awareness of reports," coupled with Apple's public advisory update coinciding with Citizen Lab's report, and Citizen Lab's "crucial role in discovering and reporting" these threats, demonstrates a vital collaboration. This, even if sometimes indirect, between a major technology company like Apple and independent cybersecurity researchers like Citizen Lab, is essential. Apple's internal detection and user notification, combined with Citizen Lab's external forensic expertise and public reporting, collectively lead to a more comprehensive understanding and effective mitigation of advanced threats. This suggests that effective cybersecurity against sophisticated, state-level threats cannot be achieved in isolation. It necessitates transparency from vendors about vulnerabilities and attacks, robust information sharing, and strong collaboration across industry, academia, civil society, and even governments. This collective approach is indispensable for identifying, understanding, and defending against sophisticated threats that transcend traditional organizational boundaries.

5. The Broader Implications: Accountability, Press Freedom, and Digital Rights

Perhaps the most troubling aspect of the proliferation of mercenary spyware is the profound lack of accountability that permeates this industry. Despite the confirmed targeting of journalists, there remains "no explanation regarding who is responsible for spying on them". This anonymity allows the customers of spyware companies to operate with impunity, making it nearly impossible to pursue legal action, impose consequences, or even understand the legal basis, if any, under which such surveillance is conducted. This lack of accountability for spyware targets underscores the ongoing and severe threat faced by journalists in Europe and globally, highlighting the inherent dangers of unchecked spyware proliferation and abuse.

Journalists are prime targets for such surveillance due to their critical role in investigative reporting, exposing corruption, and holding power accountable. The confirmed targeting of individuals like Ciro Pellegrino and the suspected targeting of the Fanpage.it news organization directly undermine press freedom, a fundamental cornerstone of democratic societies. Such surveillance creates a chilling effect, compelling journalists to self-censor or abandon sensitive stories for fear of exposing their sources or themselves to harm.

The unchecked growth and widespread availability of powerful surveillance tools pose significant broader societal implications. The commercialization of these tools makes them accessible to a wider range of actors beyond traditional nation-states, dramatically increasing the risk of human rights abuses, political repression, and illicit surveillance against civil society, dissidents, and activists globally. The dangers of spyware proliferation and abuse are a clear and present threat to digital rights worldwide.

Urgent action on a global scale is imperative. This includes the need for stricter international regulation of the mercenary spyware industry, the implementation of robust export controls on these dual-use technologies, and greater transparency from governments and private entities involved in their development, sale, and use.

The targeting of journalists, who are essential for a functioning democracy by informing the public and holding power accountable, by "mercenary spyware" that is "invisible to the target" and often lacks "accountability," has severe consequences. If journalists can be surveilled with impunity, their ability to conduct independent investigations and report freely is severely compromised, leading to self-censorship and a decline in public access to critical information. This unchecked proliferation and abuse of mercenary spyware directly undermine fundamental democratic principles such as press freedom, privacy, and the public's right to information, ultimately eroding civil liberties and potentially weakening democratic institutions from within.

Moreover, the significant "lack of accountability for spyware targets" and the absence of "explanation regarding who is responsible" point to a critical systemic issue. Mercenary spyware companies operate globally, and their "customers" can be located anywhere, often across national borders. Existing international laws, norms, and regulatory frameworks are demonstrably struggling to keep pace with the rapid technological advancements and the commercialization of sophisticated surveillance tools. This indicates a critical "global governance gap." Powerful cyber weapons, which have profound implications for human rights and national security, are being developed, sold, and deployed with minimal oversight or legal repercussions. This highlights the urgent need for international consensus, robust legal mechanisms (such as comprehensive export controls and human rights impact assessments), and sustained diplomatic pressure to control the proliferation and misuse of such dual-use technologies, akin to efforts in arms control.

6. Protecting Ourselves in a High-Stakes Digital World

In an increasingly surveilled digital world, both individuals and organizations must adopt robust digital defense strategies against sophisticated threats.

General Recommendations for Digital Hygiene:

• Keep Software Updated: It is paramount to regularly update operating systems (e.g., iOS 18.3.1 and above) and all applications. Patches like those for CVE-2025-43200 are crucial for closing known vulnerabilities that attackers exploit.

• Practice Vigilance: While zero-click attacks bypass user interaction, maintaining general cybersecurity hygiene remains vital. Users should still exercise caution regarding suspicious links, attachments, or unexpected communications, as these can still be vectors for other types of attacks.

• Enable Multi-Factor Authentication (MFA): Activating MFA for all online accounts adds a critical layer of security, significantly reducing the risk of unauthorized access even if credentials are compromised.

• Strong, Unique Passwords: The fundamental practice of using complex and unique passwords for every online service remains a cornerstone of personal cybersecurity.

• Regular Privacy Reviews: Periodically reviewing and adjusting privacy settings on devices and online accounts helps limit data exposure.

• Consider Security Tools: For organizations, deploying reputable antivirus software and advanced endpoint detection and response (EDR) solutions provides essential layers of protection against evolving threats.

The "invisible" nature of zero-click attacks means that individual user vigilance, such as the common advice to "not click suspicious links," is insufficient for defense. Protection against such advanced attacks relies heavily on platform providers rapidly patching vulnerabilities, as demonstrated by Apple's actions, and on specialized forensic researchers identifying and exposing these attacks, as exemplified by Citizen Lab's work. This indicates a significant shift in the locus of responsibility for advanced cybersecurity defense. While user hygiene remains important for common threats, the primary burden against state-level or mercenary attacks increasingly falls upon technology vendors to build inherently secure systems and to rapidly patch vulnerabilities, and upon expert researchers to uncover sophisticated exploitation. This implies a need for greater investment and accountability from these system-level entities, as individual users are largely powerless against these advanced threats on their own.

Beyond individual actions, the indispensable role of independent cybersecurity research organizations like Citizen Lab cannot be overstated. Their expertise in uncovering, analyzing, and publicly reporting on these advanced threats is crucial for holding powerful actors accountable and driving platform-level security improvements. Supporting their vital work is essential for collective digital security.

There is also a broader societal imperative for governments and international bodies to develop and enforce stronger legal frameworks. This includes implementing robust export controls on surveillance technologies, sanctioning companies and entities involved in human rights abuses, and establishing clear accountability mechanisms for the misuse of spyware.

The complex interplay of actors involved—a major technology company (Apple), independent researchers (Citizen Lab), targeted individuals (journalists), and unidentified "customers/operators" of mercenary spyware—and the multifaceted solutions required, highlight that no single entity can effectively solve the mercenary spyware problem in isolation. Technical solutions, forensic investigation, and calls for accountability and regulation are all necessary. This necessitates a comprehensive, multi-stakeholder approach involving governments enacting robust laws and export controls, tech companies prioritizing security and transparency, civil society organizations conducting research and advocacy, and international bodies fostering cooperation to develop technical defenses, legal frameworks, and ethical norms to counter the proliferation and abuse of surveillance technologies globally.

Ultimately, safeguarding an open, secure, and free internet requires a collective effort involving tech companies, governments, civil society, and informed citizens. The ongoing struggle for digital rights, privacy, and press freedom in an increasingly surveilled world demands continuous vigilance and collaborative action.

Works cited

1. Graphite Caught: First Forensic Confirmation of Paragon's iOS ..., accessed June 18, 2025, https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

2. Apple Patches Flaw Exploited in Paragon Spyware Attacks, accessed June 18, 2025, https://thecyberexpress.com/apple-patches-flaw-paragon-spyware-attacks/#google_vignette