General information
Paragon Solutions is an Israeli cybersecurity company founded in 2019. Among its co-founders are former Israeli Prime Minister Ehud Barak and Ehud Schneorson, the former commander of Unit 8200, Israel’s military intelligence unit specializing in cyber operations. Other co-founders include Idan Nurick and Igor Bogudlov, both of whom also have backgrounds in Unit 8200.[1]Globes, The company trying to give cyber intel a good name, 31.01.2022
Paragon has actively positioned itself as a “lawful” alternative to other Israeli cyber firms, particularly NSO Group, whose Pegasus spyware has been linked to surveillance abuses worldwide. The company has emphasized its strict compliance policies, claiming to sell its products only to democratic governments that adhere to human rights standards.[2]Globes, The company trying to give cyber intel a good name, 31.01.2022 and to have safeguards to prevent the kinds of spyware abuses that NSO Group and other vendors are notorious for.[3]The Citizen Lab, Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations, 19.03.2025 However, WhatsApp revealed that Paragon’s software was used against journalists and civil society members.[4]The Guardian, WhatsApp says journalists and civil society members were targets of Israeli spyware, 31.01.2025
Paragon’s US branch, Paragon Solutions (US) Inc., was established as a Delaware corporation in March 2021, and obtained a certificate to conduct business in Virginia in October 2022. Paragon US’s senior leadership is composed of American personnel with links to the US government, including a CIA veteran, a former service member and Navy program director that also worked at Twitter, and a former director of contracts at the defense contractor L3Harris.[5]The Citizen Lab, Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations, 19.03.2025
In December 2024, Paragon was acquired by the U.S.-based private equity firm AE Industrial Partners. The acquisition deal was structured with an initial payment of $500 million, with the potential to increase to $900 million based on financial performance. The funds were distributed among Paragon’s 450 employees, its co-founders, and venture capital investors such as Battery Ventures and Red Dot.[6]CTech, Spyware startup Paragon acquired for up to $900M by investment firm AE, 16.12.2024
Main Product
Paragon’s primary product, Graphite, is a surveillance tool designed to extract data from mobile applications, particularly encrypted messaging platforms like WhatsApp. Paragon’s Graphite spyware has capabilities similar to NSO Group’s notorious Pegasus. Like Pegasus, Graphite can give attackers near-complete control over infected smartphones, including access to all stored information, even encrypted messages on apps like WhatsApp and Signal.[7]CTech, Paragon’s ‘clean’ spyware image shattered by WhatsApp hacking allegations, 02.02.2025
Paragon’s spyware operates differently from traditional mobile surveillance tools. Instead of deploying its own standalone process or application, which could leave forensic traces, Paragon’s spyware integrates itself into existing, legitimate apps on a target’s device. This method reduces the likelihood of detection, as the spyware operates within trusted applications rather than as an independent, suspicious process. While Paragon’s spyware is harder for forensic analysts to detect, this approach increases the number of entities that could observe its activity, as app developers collect diagnostic data and telemetry. In 2025, information shared between the Citizan Lab, WhatsApp and Apple helped discover targets by the spyware.[8]The Citizen Lab, Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations, 19.03.2025
Usage Worldwide
Paragon is known to work in: Austria, Belgium, Cyprus, Czech Republic, Denmark, Germany, Italy, Lithuania, Netherlands, Portugal, Spain, Sweden and the US,[9]Haaretz, Israeli Spyware Firm Paragon Cuts Italy’s Access After Journalists Targeted, 06.02.2025 and is suspected to work also in Australia, Canada, Israel, and Singapore.[10]The Citizen Lab, Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations, 19.03.2025
USA: In 2022, the New York Times reported that the Drug Enforcement Administration (DEA) had used Paragon’s Graphite spyware.[11]New York Times, How the Global Spyware Industry Spiraled Out of Control, 08.12.2022 In 2024, it was revealed that a $2 million contract was signed between Paragon and Immigration and Customs Enforcement(ICE).[12]Wired, ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions, 01.10.2024 In September 2025, after Trump’s return to office, Paragon singed a new deal with ICE and supplied its products to the agency.[13]The Guardian, Tech giants vow to defend users in US as spyware companies make inroads with Trump administration, 10.11.2025
Italy: In January 2025, WhatsApp reported that spyware developed by Paragon had compromised the accounts of nearly 100 journalists and civil society activists.[14]Haaretz, WhatsApp Says Israeli Spyware Company Paragon Targeted Dozens of Journalists, Civil Society Activists, 31.01.2025 Following the revelation, Paragon stated it terminated all ties with the country and disconnect its two Italian clients, a law enforcement agency and an intelligence organization.[15]Haaretz, Israeli Spyware Firm Paragon Cuts Italy’s Access After Journalists Targeted, 06.02.2025
Canada: In 2025, the Citizen Lab’s investigation surfaced potential links between Paragon Solutions and the Canadian Ontario Provincial Police(OPP).[16]The Citizen Lab, Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations, 19.03.2025
Usage by Israel
There is limited publicly available information regarding the deployment of Paragon’s spyware in Israel. In 2025, the Citizen Lab’s investigation identified suspected Paragon deployments in Israel.[17]The Citizen Lab, Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations, 19.03.2025