Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers - The Citizen Lab Archived: 2026-04-05 16:44:08 UTC Key Findings Based on an analysis of samples shared with us by Microsoft Threat Intelligence, we developed indicators that enabled us to identify at least five civil society victims of QuaDream’s spyware and exploits in North America, Central Asia, Southeast Asia, Europe, and the Middle East. Victims include journalists, political opposition figures, and an NGO worker. We are not naming the victims at this time. We also identify traces of a suspected iOS 14 zero-click exploit used to deploy QuaDream’s spyware. The exploit was deployed as a zero-day against iOS versions 14.4 and 14.4.2, and possibly other versions. The suspected exploit, which we call ENDOFDAYS, appears to make use of invisible iCloud calendar invitations sent from the spyware’s operator to victims. We performed Internet scanning to identify QuaDream servers, and in some cases were able to identify operator locations for QuaDream systems. We detected systems operated from Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates (UAE), and Uzbekistan. QuaDream has had a partnership with a Cypriot company called InReach, with whom it is currently embroiled in a legal dispute. Numerous key individuals associated with both companies have prior connections with another surveillance vendor, Verint, as well as Israeli intelligence agencies. 1. Background: QuaDream and InReach QuaDream QuaDream Ltd (מ“בע קוודרים (is an Israeli company that specialises in the development and sale of advanced digital offensive technology to government clients. The company is known for its spyware marketed under the name “Reign”, which, like NSO Group’s Pegasus spyware, reportedly utilises zero-click exploits to hack into target devices. Recent media reports indicate that QuaDream has sold its products to a range of government clients including Singapore, Saudi Arabia, Mexico, and Ghana, and has pitched its services to Indonesia and Morocco. Additionally, in their December 2022 Threat Report on the Surveillance-for-Hire Industry, Meta mentions that they detected activity on their platforms that they attributed to QuaDream. The activity included the use of “about 250 accounts”, which Meta assessed were being used to test the capabilities of QuaDream’s iOS and Android spyware. QuaDream operates with a minimal public presence, lacking a website, extensive media coverage, or social media presence. QuaDream employees have reportedly been instructed to refrain from mentioning their employer on social media. However, we have been able to identify several key figures associated with the company, including its three founders (Ilan Dabelstein, Guy Geva, and Nimrod Rinsky), through a review of corporate documentation, newspaper articles, and databases. We list these key individuals in Appendix A. https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ Page 1 of 14 QuaDream is enmeshed in a legal dispute with InReach, a Cyprus-registered company. This dispute has resulted in the exposure of interesting details about the companies’ business. According to court documents obtained from the District Court of Limassol in Cyprus (the Cypriot Case File), QuaDream sold its products outside of Israel through InReach, a company registered in Cyprus. While the open-source information and court documents we reviewed strongly suggest that QuaDream sold its products outside of Israel through InReach, it is essential to note that this does not necessarily indicate that InReach was the exclusive or primary distributor for QuaDream. InReach InReach was incorporated in Cyprus in September 2017. According to assertions made by QuaDream in the Cypriot Case File, InReach was set up for the sole purpose of promoting QuaDream’s products outside of Israel. According to the file, a “Consortium Agreement” was signed between QuaDream and InReach on 5 July 2017, and that QuaDream took the initiative to establish the consortium in order to sell their products outside Israel. The agreement stipulated that QuaDream would receive 92% of the revenues from the sales of QuaDream’s products, with InReach keeping the remaining 8%. We identify key individuals associated with InReach in Appendix A, through a review of corporate documents, newspaper articles, and various databases. The Dispute Between QuaDream and InReach One helpful source of information about QuaDream’s activities is an ongoing legal dispute between QuaDream and InReach. The dispute has resulted in revelations regarding QuaDream’s business practices. The relationship between QuaDream and InReach appears to be a combination of both personal and mutual interest connections. There are notable intersections (Appendix A) between the two corporations and many of the key individuals from both companies seem to have former connections to Verint as well as Israeli intelligence agencies. According to the Cypriot Case File, a dispute arose between the companies when InReach failed to transfer to QuaDream 92% of the revenues arising from sales of QuaDream’s products, starting with an invoice dated 26 June 2019. On 7 May 2020, QuaDream applied to the court in Cyprus to freeze InReach’s assets, pending potential arbitration in the Court of Arbitration in Amsterdam. To support their claim for a freezing order, QuaDream presented an English legal opinion which states that QuaDream is entitled to receive the sum of US$6,079,814 from InReach (this amount presumably reflecting 92% of sales of QuaDream’s products that InReach had failed to transfer, starting with the June 2019 invoice). https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ Page 2 of 14 In the application for a freezing order, QuaDream claimed that InReach attempted to conceal and divest the assets of the consortium through fraudulent means, including by opening up a secret bank account in Switzerland and then attempting to funnel payments from customers into this new bank account, without QuaDream’s knowledge. QuaDream claimed that InReach fired Lora Plotkin (Appendix A), a QuaDream shareholder who had signing and supervisory rights on the InReach bank account which received payments from customers, on April 17, 2020, so that InReach could funnel payments into the secret account without QuaDream’s authorisation. The District Court of Limassol granted the freezing order to QuaDream and the dispute is ongoing. 2. Analysis of a Software Component Attributable to QuaDream Microsoft Threat Intelligence shared with the Citizen Lab two samples of iOS spyware that they call KingsPawn, and attribute to QuaDream with high confidence. (Read the Microsoft Threat Intelligence analysis of the spyware here). We subsequently analysed these binaries, seeking to develop indicators that could be used to identify a device compromised with QuaDream spyware. The following section describes elements of our analysis of the spyware. Sample 1 appeared to be a downloader designed to exfiltrate basic device information, and download and execute an additional payload. Sample 2 appeared to be a full featured spyware payload. Nevertheless, both Sample 1 and Sample 2 shared highly distinctive commonalities, including largely identical functions for spawning processes. The functions create (and later remove) a distinctive subfolder within the com.apple.xpc.roleaccountd.staging folder on the phone: /private/var/db/com.apple.xpc.roleaccountd.staging/PlugIns/fud.appex/ Additionally, both Sample 1 and Sample 2 parse the same distinctive JSON encoding of 40 kernel memory offsets that provide the location of various iOS kernel structures presumably important for the spyware’s operation. We suspect that this encoding is generated by an earlier stage in the exploit chain, and passed to Samples 1 and 2. In addition to the high-confidence attribution by Microsoft Threat Intelligence to QuaDream, we found several references linkable to QuaDream in Sample 1. The second sample, Sample 2, did not contain these references. Functionality Sample 1 appeared to be an initial payload whose purpose was to download another payload. Sample 2, however, appeared to be the final spyware payload. Our analysis of Sample 2 allowed us to identify a range of functionality that helps the implant perform its core surveillance capabilities. Like other, similar, mercenary spyware the implant has a range of capabilities from hot-mic audio recording of calls and the environment, to more advanced capabilities to search through the phone. https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ Page 3 of 14 Sample 2 appears to have functionality for: Recording audio from phone calls Recording audio from the microphone Taking pictures through the device’s front or back camera Exfiltrating and removing items from the device’s keychain Hijacking the phone’s Anisette framework and hooking the gettimeofday syscall to generate iCloud time-based one-time password (TOTP) login codes for arbitrary dates. We suspect that this is used to generate two-factor authentication codes valid for future dates, in order to facilitate persistent exfiltration of the user’s data directly from iCloud Running queries in SQL databases on the phone Cleaning remnants that might be left behind by zero-click exploits Tracking the device’s location Performing various filesystem operations including searching for files matching specified characteristics https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ Page 4 of 14 We found that the spyware also contains a self-destruct feature that cleans up various traces left behind by the spyware itself. Our analysis of the self-destruct feature revealed a process name used by the spyware, which we discovered on victim devices. QuaDream Spyware Process Name Emerges A function in Sample 2 hard-codes the path to the main spyware payload (in a XOR-obfuscated string) as /private/var/db/com.apple.xpc.roleaccountd.staging/subridged. While subridged is the name of a legitimate iOS executable, the legitimate subridged would not be launched from the /private/var/db/com.apple.xpc.roleaccountd.staging/ directory. This process name has never been observed used by NSO Group’s Pegasus spyware (which also uses the /private/var/db/com.apple.xpc.roleaccountd.staging/ directory), nor any other type of spyware of which we are aware. Another function in Sample 2 removes entries from the /private/var/root/Library/Caches/locationd/clients.plist file, which is a well-publicised forensic source where spyware indicators may persist. The function attempts to remove entries ending in the string “subridged” from this file. Cleanup Code Highlights Suspected Zero-Click Exploits We identified functionality within Sample 2 that deletes events from the iOS calendar. The functionality is located in two “Calendar Cleanup Functions”, which we refer to as CCF1 and CCF2. The functions appear to be executed when a special cleanup command is received from the spyware’s command-and-control server. The cleanup command includes an email address that specifies the scope of the cleanup. CCF1 enumerates (via EventKit) all calendar events in all calendars whose start date is after 728 days ago, and checks whether the email address of the event’s organiser is equal to the supplied email address. If so, then the event is removed via the -[EKEventStore removeEvent:span:commit:error:] function. CCF2 opens the SQLite database that stores calendar information on the phone, located at /var/mobile/Library/Calendar/Calendar.sqlitedb, using the following parameters: file:%s?cache=shared&mode=rwc&_journal_mode=WAL&_timeout=10000 CCF2 then checks to see if the supplied email address is present in the ‘Participant’ table in the database: SELECT DISTINCT identity_id FROM Participant WHERE email = "%s" If present, then these deletion queries are run: DELETE FROM Identity WHERE ROWID = %d; DELETE FROM CalendarItemChanges WHERE record IN ( SELECT owner_id FROM ParticipantChanges WHERE email DELETE FROM ParticipantChanges WHERE email = "%[2]s"; Finally, CCF2 vacuums the database: https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ Page 5 of 14 VACUUM; PRAGMA wal_checkpoint(TRUNCATE); The same cleanup command that triggers deletion of calendar events associated with a specific email address also causes that same email address to be removed from the com.apple.identityservices.idstatuscache.plist file (in /private/var/mobile/Library/Preferences/). In iOS versions 14.6 and prior, this file contained a record of iCloud accounts that the device had interacted with using certain Apple services (e.g., iMessage). This file appears to have been deprecated since iOS version 14.7, and no longer stores any information. The Ectoplasm Factor We noted functionality within Sample 2 that sometimes leaves traces behind on infected devices after the spyware is removed. We refer to these traces as the Ectoplasm Factor. We omit discussion of the Ectoplasm Factor from our report, as we believe this may be useful for tracking QuaDream’s spyware going forward. Exfiltration The spyware exfiltrates data via HTTPS POST requests. The spyware’s exfiltration module appears to have the capability to use a custom root certificate for this HTTPS connection, indicating that exfiltration may involve self-signed certificates.  Separately, we observed suspected QuaDream exfiltration to servers returning self-signed Kubernetes certificates. 3. Target Forensics We uncovered clues that we believe are linked to QuaDream’s iOS 14 zero-click exploit. While NSO Group was deploying FORCEDENTRY as a zero-click, zero-day exploit against iOS 14 devices, QuaDream appears to have been deploying a separate zero-click, zero-day exploit against iOS 14 devices that we refer to as ENDOFDAYS. Apple reportedly notified targets of both Pegasus and QuaDream hacking in a round of notifications issued on 23 November 2021. We shared our analysis of this attack with Apple Inc. at multiple points during our investigation. ENDOFDAYS, a Possible Zero-Click Exploit We identified two 2021 cases where targets in North America and Central Asia showed evidence that a process named /private/var/db/com.apple.xpc.roleaccountd.staging/subridged had run on the phone on iOS versions 14.4 and 14.4.2, while these were the latest iOS versions. In one case, we were able to examine the user’s Calendar.sqlitedb file, and also connect (via CalDAV) to their iCloud calendar. The user’s Calendar.sqlitedb file showed a suspicious event added to the calendar in 2021 organised by a user [REDACTED1]@icloud.com. The summary of the event was “Meeting”, and the description of the event was “Notes”. We obtained an .ics file for this event from their iCloud calendar via CalDAV. The event contained remnants of a possible XML escape, where the CDATA opening and closing tags were embedded in keys in the .ics file (highlighted below). https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ Page 6 of 14 DESCRIPTION]]>:x ATTENDEE;EMAIL=[redacted victim]... ATTENDEE /path/to/event.ics "..."