Carmine Tsunami, identified by Microsoft as DEV-0196, emerged with documented activities in 2021, evolving as an Israeli private sector offensive actor (PSOA) that develops and sells advanced mobile surveillance platforms to government clients. Its primary motivation is financial gain through the sale of its spyware, which is subsequently abused by its customers for cyber espionage. This group is distinguished by its focus on providing sophisticated zero-click exploits, particularly for iOS devices, enabling clients to conduct covert surveillance against high-value targets such as civil society members, journalists, and political opposition figures. Carmine Tsunami operates under the alias QuaDream, and its flagship spyware platform is known as Reign, which was also found to involve the KingsPawn malware.

Aliases del actor

DEV-0196QuaDream

Actores similares

devmanransomware · 184Network Devicesactor · 1Compromise Software Dependencies and Development Toolsactor · 1Device Driver Discoveryactor · 1CS FQL: 32. Detect Data Exfiltration via external storage devicesactor · 1dev-0322actor · 1dev-0343actor · 1weredevilsactor · 1DEV-0147apt · 0Caramel Tsunamiapt · 0