Graphite Spyware Uses iOS Zero-Click Flaw to Target Journalists

Security researchers at Citizen Lab have uncovered the first forensic evidence linking Paragon’s Graphite mercenary spyware to zero-click attacks on journalists’ iPhones.

The campaigns exploited a now-patched iMessage vulnerability (CVE-2025-43200) to compromise devices running iOS 18.2.1, highlighting the persistent threat of state-aligned surveillance against civil society

Technical Overview of the Attack Chain

According to the report, the attacks leveraged a zero-click iMessage exploit requiring no user interaction.

Key technical elements include:

• Vulnerability: CVE-2025-43200, a logic flaw in processing malicious iCloud Links containing images/videos, patched in iOS 18.3.1 (February 2025).
• Delivery Mechanism: An iMessage account (ATTACKER1) sent weaponized media files via iCloud, triggering remote code execution.
• Command-and-Control (C2) Infrastructure: Infected devices communicated with 46.183.184[.]91, a server hosted by EDIS Global and linked to Paragon’s Graphite spyware through Fingerprint P1.

Forensic logs confirmed the spyware operated stealthily, exfiltrating data without leaving visible traces.

Confirmed Targeting of European Journalists

Case 1: Prominent European Journalist

• Infection Period: January–February 2025 (iOS 18.2.1).
• Forensic Evidence:
  • Repeated connections to 46.183.184[.]91 during the compromise window1.
  • Presence of ATTACKER1 in device logs, tied to Graphite’s zero-click deployment.

Case 2: Ciro Pellegrino (Fanpage.it Journalist)

• Infection Method: Same ATTACKER1 iMessage account used, confirming a shared Paragon operator.
• Scope: Pellegrino’s colleague, Francesco Cancellato, received a WhatsApp notification in January 2025 about Graphite targeting, though forensic confirmation remains pending.

Broader Implications and Responses

The attacks underscore systemic risks to press freedom:

• Italian Government Involvement: A parliamentary committee (COPASIR) acknowledged using Graphite against activists but denied targeting journalists.
• Paragon’s Role: The Israeli firm, recently acquired by a U.S. private equity group, markets Graphite as a lawful intercept tool.
• Despite contract terminations with Italy, its infrastructure remained active until April 2025.
• Accountability Gaps: No entity has claimed responsibility for the targeting, highlighting the opacity of mercenary spyware ecosystems.

Confirmed Paragon Spyware Cases in Italy

The table below summarizes forensic findings across targeted individuals:

Name	Notification Source	Forensic Confirmation	Additional Findings
Ciro Pellegrino	Apple (April 29, 2025)	Yes	ATTACKER1 iMessage account; Graphite C2 server links.
Prominent EU Journalist	Apple (April 29, 2025)	Yes	Infections Jan–Feb 2025; server 46.183.184[.]91.
Luca Casarini	WhatsApp	Yes	Graphite’s BIGPRETZEL indicator on Android (Dec 2024–Jan 2025).
Giuseppe Caccia	WhatsApp	Yes	BIGPRETZEL activity confirmed on December 23, 2024.
Francesco Cancellato	WhatsApp (Jan 2025)	Pending	No Android logs found; analysis ongoing.

---

Mitigation and Ongoing Risks

Apple’s patch renders CVE-2025-43200 inert, but Graphite’s modular infrastructure suggests evolving capabilities.

Citizen Lab urges at-risk individuals to:

• Enable Lockdown Mode on iOS.
• Seek assistance from groups like Access Now’s Digital Security Helpline.

The findings reinforce calls for stricter regulation of commercial spyware, particularly as democracies increasingly weaponize these tools against dissidents and journalists.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates