Ankura CTIX FLASH Update - April 14, 2023

Malware Activity

Private Sector Offensive Actor QuaDream Linked to DEV-0196

Microsoft researchers have linked, with high confidence, a threat group tracked as DEV-0196 to an Israel-based private sector offensive actor (PSOA) known as QuaDream. QuaDream has been targeting the iOS devices of journalists and political figures across Europe, North America, Southeast Asia, and the Middle East with malicious spyware. QuaDream is known to market a surveillance platform to governments for "law enforcement purposes" known as "REIGN," which is "a suite of exploits, malware, and infrastructure designed to exfiltrate data from mobile devices." The malware, dubbed "KingsPawn," is developed by DEV-0196 and has a monitor agent that is responsible for reducing the malware's footprint on the victim device to evade detection. The primary malware agent has the capabilities to collect device data, cellular and Wi-Fi data, access location, gather files, access the device's camera,