Microsoft researchers have linked, with high confidence, a threat group tracked as DEV-0196 to an Israel-based private sector offensive actor (PSOA) known as QuaDream. QuaDream has been targeting the iOS devices of journalists and political figures across Europe, North America, Southeast Asia, and the Middle East with malicious spyware. QuaDream is known to market a surveillance platform to governments for “law enforcement purposes” known as “REIGN,” which is “a suite of exploits, malware, and infrastructure designed to exfiltrate data from mobile devices.” The malware, dubbed “KingsPawn”, is developed by DEV-0196 and has a monitor agent that is responsible for reducing the malware’s footprint on the victim device to evade detection. The primary malware agent has the capabilities to collect device data, cellular and Wi-Fi data, access location, gather files, access the device’s camera, obtain call logs, and more. Citizen Lab researchers also observed a “zero-click exploit” dubbed “ENDOFDAYS” which they suspect was used to hack into target devices with the iOS versions of 14.4 and 14.4.1. Researchers explained that the exploit uses two (2) backdated and overlapping iCloud calendar invites (that are invisible to the account owner) as an initial attack vector and are automatically processed due to a flaw in iOS 14, which does not notify the account owner of these invites. When deployed, the spyware attempts to bypass detection by covering its tracks. QuaDream has previously been in the media for taking advantage of the FORCEDENTRY zero-click exploit in iMessage in order to deploy REIGN in early 2022, and approximately 250 of its fraudulent Instagram and Facebook accounts that were used to “infect Android and iOS devices and exfiltrate personal data” were taken down in late 2022. Additional technical details regarding DEV-0196 and QuaDream, as well as indicators of compromise (IOCs), can be viewed in the two reports linked below.