Citizen Lab reported on March 19, 2025, that infrastructure probably linked to Paragon Solutions’ Graphite spyware pointed to suspected deployments in Australia, Canada, Cyprus, Denmark, Israel and Singapore. The finding is not proof that all six governments signed contracts with Paragon. It is a technical attribution based on servers, certificates, hostnames and network locations, with the strongest country-specific link involving Canada’s Ontario Provincial Police (OPP).
What Citizen Lab actually identified
The University of Toronto’s Citizen Lab described its findings in report No. 183, “Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations,” published March 19, 2025. Researchers said they found a subset of infrastructure that, with “strong circumstantial evidence,” could be attributed to Paragon’s Graphite platform.
As an Amazon Associate I earn from qualifying purchases.
That wording matters. The report identified suspected deployments and likely customers, not six publicly confirmed purchases. It did not establish which agencies operated every server, whether each deployment was active when the report was published, or whether any named government used the spyware unlawfully.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchParagon is an Israel-based commercial spyware company founded in 2019. Its main product, Graphite, has been marketed as a more responsible alternative to tools such as NSO Group’s Pegasus. Paragon has said it sells to governments that respect international norms and fundamental rights and excludes authoritarian or nondemocratic governments. The infrastructure findings put that positioning under scrutiny, but they do not by themselves prove abuse.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Citizen Lab’s report is available at Citizen Lab.
The six suspected customer countries
| Country | Technical indication | What remains unproven |
|---|---|---|
| Australia | Suspected infrastructure associated with Australian IP addresses and customer-like hostnames including defanged forms of “external-astra” and “internal-Abba.” | No public confirmation of an Australian government contract or operating agency. |
| Canada | A suspected deployment was linked to infrastructure associated with the Ontario Provincial Police. | The OPP did not confirm a Paragon purchase, and no specific Canadian target or misuse was established. |
| Cyprus | An IP address geolocated to Cyprus and a hostname beginning with “external-cag.” | The location and naming pattern remain circumstantial attribution, not procurement proof. |
| Denmark | A Danish IP address and the hostname “external-drt.” | No Danish agency or contract was publicly identified. |
| Israel | Israeli infrastructure returned Paragon-branded webpages and certificates connected with Graphite-related systems. | Israel is methodologically different because Paragon is based there; the finding does not identify a particular Israeli customer. |
| Singapore | Several suspected deployments used Singaporean IP addresses and multiple “sht”-related hostnames. | The report did not name a Singaporean agency or confirm a purchase. |
These six countries are a subset of suspected deployments, not a complete customer list. Citizen Lab said internet-scanning data do not preserve every historical server, and customers can hide infrastructure behind restricted access, contractors or intermediaries.
How the technical attribution worked
Citizen Lab began with information from a collaborator and mapped systems associated with Graphite. The researchers developed fingerprints for Paragon-related servers and certificates, then compared those fingerprints with internet-visible infrastructure.
Certificates and webpages
Some Israeli IP addresses returned webpages titled “Paragon.” A TLS certificate included the organization name “Graphite,” and the common name “installerserver” appeared in the same ecosystem. Those details helped connect otherwise separate hosts to the spyware platform.
Hostnames, locations and codenames
Researchers examined customer-like hostnames and compared their apparent codenames with the country where a server was located. Local telecommunications providers hosted some systems, a pattern Citizen Lab said was consistent with customer-operated deployments.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few clicks, and your info stays protected on public Wi-Fi every time you connect.
- PERSONAL DATA SCANS – Take your info off the market. We’ll find your personal information on sites selling it, then guide you on how to remove it.
- SOCIAL PRIVACY MANAGER – Decide what you share. McAfee finds the privacy settings buried in your social accounts and fixes them.
That is strong technical evidence, but it has limits. IP geolocation identifies a network location, not necessarily the operator. A government may lease a server through a telecom company or contractor; IP addresses can be reassigned; hostnames can be suggestive without being conclusive; and shared hosting can blur ownership.
Why “likely customer” does not mean “confirmed buyer”
The report did not include public contracts, invoices, procurement records or admissions from each named country. Its conclusions combine several indicators:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Infrastructure technically linked to Graphite or Paragon.
- Certificates and webpages associated with the company or product.
- Country-level IP geolocation.
- Customer-like naming and deployment patterns.
- In Canada, a direct association between suspected infrastructure and the OPP.
Each indicator narrows the possibilities, but none alone proves who signed a contract. A server can be managed by Paragon, a customer or an intermediary. Scans can miss short-lived, concealed or access-controlled systems. Italy, which was later acknowledged as a Paragon customer, was not necessarily visible through this same scanning method.
The Ontario Provincial Police connection
Canada is the most specific of the six country findings. Citizen Lab linked one suspected Canadian deployment to infrastructure associated with the Ontario Provincial Police and described it as evidence of a growing spyware ecosystem among Ontario-based police services.
Asked about the finding, the OPP did not deny using the technology. Its spokesperson said that discussing investigative technologies could jeopardize active investigations and public or officer safety. That is a non-denial, not a public confirmation of a Paragon contract.
Rank #3
- MCAFEE TOTAL PROTECTION IS ALL-IN-ONE PROTECTION — delivering award-winning antivirus for 3 devices, with identity monitoring and VPN
- ID MONITORING — we'll monitor everything from email addresses to IDs and phone numbers for signs of breaches. If your info is found, we'll notify you so you can take action
- BANK, SHOP, AND BROWSE ANYWHERE SECURELY WITH UNLIMITED VPN — protect your online privacy automatically when connecting to public Wi-Fi
- SECURE YOUR ACCOUNTS — generate and store complex passwords with a password manager
- AWARD-WINNING ANTIVIRUS — rest easy knowing McAfee will notify you of risky websites and protect you from the latest threats
The evidence therefore supports three different statements: Canada was identified as a suspected deployment location; the OPP appeared connected to one deployment; and a confirmed procurement or confirmed spyware operation against a particular Canadian person was not established in the cited material.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WhatsApp’s zero-click investigation
The infrastructure work also fed into a separate, more concrete event. Citizen Lab shared its analysis with Meta, which said the information was pivotal to WhatsApp’s investigation of Paragon.
WhatsApp identified and mitigated an active Paragon zero-click exploit and, on January 31, 2025, notified approximately 90 accounts it believed had been targeted. Recipients included journalists and civil-society members, particularly in Italy.
“Zero-click” means a target may not need to click a link or open an attachment. In the reported attack, WhatsApp processed malicious content; the service’s intervention blocked that path and enabled notifications. The alerts helped bring the Italian cases to public attention.
What Graphite does—and how it differs from Pegasus
Citizen Lab described Graphite as appearing to target messaging applications rather than necessarily taking complete control of an entire phone. That differs from the full-device compromise commonly associated with Pegasus, although the comparison is about observed operation, not a definitive ranking of capabilities.
Rank #4
- DEVICE SECURITY - Award-winning McAfee antivirus, real-time threat protection, protects your data, phones, laptops, and tablets
- SCAM DETECTOR - We'll automatically identify risky texts, emails, and videos that attempt to steal your personal or financial information. You can even use our mobile app to check social messages and QR codes for scams on-demand, without missing a beat.
- SECURE VPN – Secure and private browsing, unlimited VPN, privacy on public Wi-Fi, protects your personal info, fast and reliable connections
- IDENTITY MONITORING – 24/7 monitoring and alerts, monitors the dark web, scans up to 60 types of personal and financial info
- SAFE BROWSING – Guides you away from risky links, blocks phishing and risky sites, protects your devices from malware
Access to a messaging app can still expose conversations, contacts, files and relationship networks. App-focused compromise may leave fewer traces in traditional device forensics, while the affected app provider may have better visibility into the attack path.
The BIGPRETZEL artifact
Citizen Lab identified BIGPRETZEL as an Android forensic artifact it believed was uniquely indicative of Graphite. WhatsApp separately told the lab that it believed BIGPRETZEL was associated with Paragon. Researchers found traces on two Android devices belonging to people in the Italian target cluster.
BIGPRETZEL is not a consumer antivirus signature. Not every notified person will have recoverable evidence, and a clean device examination does not prove that targeting did not occur: Android systems may delete or fail to retain the relevant logs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Italy: a separate, more firmly established case
Italy should not be folded into the six-country infrastructure list. It was a separate strand of the investigation and was reportedly an acknowledged Paragon customer. Citizen Lab examined Android devices belonging to Italian activists who had received WhatsApp notifications and found clear signs that Graphite had been loaded into WhatsApp and other apps on some devices.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsItaly’s intelligence service reportedly acknowledged deploying Graphite in a classified hearing. On February 14, 2025, the Italian government said it and Paragon had agreed to suspend deployment while an investigation took place. The cases included activists connected to migrant-rights work.
Best Value
- DEVICE SECURITY - Award-winning McAfee antivirus, real-time threat protection, protects your data, phones, laptops, and tablets
- SCAM DETECTOR - We'll automatically identify risky texts, emails, and videos that attempt to steal your personal or financial information. You can even use our mobile app to check social messages and QR codes for scams on-demand, without missing a beat.
- SECURE VPN – Secure and private browsing, unlimited VPN, privacy on public Wi-Fi, protects your personal info, fast and reliable connections
- IDENTITY MONITORING – 24/7 monitoring and alerts, monitors the dark web, scans up to 60 types of personal and financial info
- SAFE BROWSING – Guides you away from risky links, blocks phishing and risky sites, protects your devices from malware
A related case involved an attempted infection of an iPhone belonging to David Yambio. Citizen Lab did not conclusively attribute that attack to Paragon. Apple said it had patched the relevant attack vectors in iOS 18.
What Paragon and governments said
TechCrunch contacted Australia, Canada, Cyprus, Denmark, Israel, Singapore and the OPP. The national governments did not respond to its requests for comment. The OPP issued the non-denial described above.
Paragon executive chairman John Fleming said Citizen Lab had provided limited information and that some of it appeared inaccurate. Paragon did not specify which information it disputed and did not answer whether the named countries were customers. Nonresponse is not confirmation or denial, so the public record remains incomplete.
TechCrunch’s account is available at TechCrunch.
What the findings do not establish
- That all six governments purchased Graphite.
- Which agencies in Australia, Cyprus, Denmark, Israel or Singapore operated the suspected infrastructure.
- That every deployment was active on March 19, 2025.
- That any named government used Graphite unlawfully.
- Which people were targeted by each suspected deployment, or how many victims there were.
- That the six-country list represents Paragon’s complete customer base.
- That every attack in the Italian cluster came from Paragon.
What journalists, activists and other users can do
Commercial spyware is designed to evade ordinary detection, so consumer antivirus software cannot be treated as a reliable test. Practical steps are:
- Install operating-system and app updates promptly, including security releases.
- Treat an Apple, WhatsApp or other vendor threat notification as urgent and follow the provider’s instructions.
- Preserve notification details and seek help from a reputable digital-security organization or specialist security lab.
- High-risk users—such as journalists, activists, lawyers and political figures—should seek device-specific guidance from Apple, Meta, Access Now or an established forensic expert.
- Do not infer safety from the absence of BIGPRETZEL or another artifact; missing logs can mean missing evidence, not no targeting.
Citizen Lab’s spyware litigation and formal-complaints tracker provides broader context on legal challenges involving mercenary spyware: Citizen Lab tracker.
Bottom line
Citizen Lab’s six-country list is best understood as a map of technically suspected Paragon deployments, not a verified roster of government buyers. The Canadian link to the OPP is unusually specific, while Italy supplies the clearest public evidence of actual Graphite use and targeting. The investigation shows how infrastructure analysis, app-provider telemetry and device forensics can fit together—but also why attribution, procurement and unlawful surveillance must remain separate claims.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
