Carmine Tsunami is a threat actor linked to Israel-based QuaDream, known for targeting civil society with iOS KingsPawn malware.
Analyst brief
Carmine Tsunami is a threat actor linked to the Israel-based private sector offensive actor QuaDream. They primarily target civil society individuals such as journalists, political opposition figures, and NGO workers. Their main TTPs include the iOS malware KingsPawn, utilizing the REIGN platform for data exfiltration, and deploying infrastructure with single domains per IP, cheap cloud hosting, and free Let's Encrypt SSL certificates. Defenders should focus on mobile device security, unusual domain registration patterns, and signs of unauthorized data exfiltration.
Carmine Tsunami
DEV-0196QuaDream
unknown
Carmine Tsunami is a threat actor linked to an Israel-based private sector offensive actor called QuaDream. QuaDream sells a platform called REIGN to governments for law enforcement purposes, which includes exploits, malware, and infrastructure for data exfiltration from mobile devices. Carmine Tsunami is associated with the iOS malware called KingsPawn and has targeted civil society victims, including journalists, political opposition figures, and NGO workers, in various regions. They utilize domain registrars and inexpensive cloud hosting providers, often using single domains per IP address and deploying free Let's Encrypt SSL certificates.