Resources

Graphite Caught

First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations

The Citizen Lab’s March 19, 2025 report delivers the first comprehensive examination of Paragon Solutions’ Graphite spyware. It maps its global infrastructure, exposing suspected state clients (including Canada’s Ontario Provincial Police), and detailing forensic evidence of zero-click exploits against civil society targets in Italy and elsewhere.

European Parliament's PEGA Committee - Final Report

This final recommendation followed the PEGA Committee's investigation and confirmed evidence of "contraventions and maladministration" of EU law in Poland, Hungary, and Greece concerning spyware use, and identified a need for legal reform in Spain and scrutiny in Cyprus. It strongly condemned the illegitimate use of spyware by Member State governments and state institutions for political purposes, such as monitoring, blackmailing, intimidating, manipulating, and discrediting opposition members, critics, and civil society, and undermining the rule of law. It noted that it could be "safely assumed that all Member States have purchased or used one or more spyware systems"

The Predator Files

This report lays out the human rights implications of the Predator Files disclosures, which show how a suite of highly invasive surveillance technologies supplied by the Intellexa alliance is being sold and transferred around the world with impunity. These findings make clear, yet again, that the unchecked sale and transfer of surveillance technologies could continue to facilitate human rights abuse on a massive global scale, as companies are still being allowed to freely sell and transfer their wares in utmost secrecy.

CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru

This extensive investigation identified at least 65 individuals in Catalonia who were targeted or infected with mercenary spyware, predominantly Pegasus (63 individuals) and some with Candiru (4 individuals), with at least two individuals infected by both. Victims included Members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organizations, with family members also affected. The report found strong circumstantial evidence pointing to Spanish authorities as responsible for the operations, which largely occurred between 2017 and 2020. It also detailed the use of sophisticated exploit techniques, including zero-click exploits and SMS-based targeting. Amnesty International's Security Lab independently validated Citizen Lab's forensic methodology for this repor

Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru

Report by CitizenLab on the extensive mercenary spyware operation against catalan civil society

Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus

This report identified over 750 websites linked to Candiru's spyware infrastructure and documented the recovery of Candiru's Windows spyware from a politically active victim in Western Europe. Through collaboration with Microsoft, the report led to the discovery and patching of two privilege escalation vulnerabilities (CVE-2021-31979 and CVE-2021-33771) exploited by Candiru. Microsoft's subsequent investigation, based on this report, observed at least 100 victims in various countries, including human rights defenders, dissidents, journalists, activists, and politicians

Pegasus vs. Predator

Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware

The Pegasus Project

This initiative, launched in 2021, revealed extensive government espionage on journalists, opposition politicians, activists, businesspeople, and others using Pegasus spyware developed by the Israeli NSO Group. It uncovered a leaked list of over 50,000 phone numbers believed to be "people of interest" to NSO Group clients, which included leading opposition politicians, human rights activists, journalists, and lawyers. Forensic examination of some phones by Amnesty International's cybersecurity team confirmed Pegasus infections. The investigation reported that 14 heads of state were among the targets. It showed that Pegasus was widely used by authoritarian governments to spy on civil society, contradicting NSO's claims of its use being limited to serious crime and terrorism

Catalonia reignites its court fight with Spain over spyware

@POLITICOEurope — one of the most influential outlets among EU decision-makers — covered our new legal action against the providers of mercenary spyware NSO Group (Pegasus) and Saito Tech Ltd (Candiru), as well as against Spain’s CNI and Guardia Civil. The news appeared yesterday in the Cyber Insights Europe newsletter, today as a standalone article on Pro, and in an open-access piece for all readers.

La seguretat, amenaçada

El Punt Avui reported on May 5, 2025, that Sentinel Alliance members filed a renewed criminal complaint in Barcelona alleging unlawful deployment of Pegasus and Candiru spyware by Spain’s National Intelligence Centre, the Guardia Civil, and the two software vendor

Parliament of Catalonia Hearing - European Union and Foreign Action Committee (CUEAE)

On March 6th 2025 Joan Arús took part in the hearing held by the European Union and Foreign Action Committee (CUEAE) of the Parliament of Catalonia, representing Sentinel Alliance.

Víctimas de ciberespionaje se querellan contra el ex altos cargos del CNI y de la Guardia Civil y los fabricantes de Pegasus y Candiru

Joan Arús: "Només amb el teu número de mòbil ja poden accedir als teus continguts i credencials"

In this interview, we speak with Joan Arús about the dangers of exposing personal data online and the actions being taken by Sentinel Alliance, an organization formed to confront state surveillance. We live in an era where technology is evolving at a rapid pace, but this also brings serious challenges in terms of privacy and individual freedoms. The Catalangate scandal of 2022, in which 65 people were allegedly spied on by the state, highlighted the severity of these issues. To address this, Sentinel Alliance — the first association of victims of state espionage — was officially launched on Friday, November 29.

Presentada querella criminal contra Pegasus, Candiru, CNI i Guàrdia Civil

Víctimas de espionaje presentan una querella contra el CNI, la Guardia Civil y los fabricantes de Pegasus y Candiru

Víctimas de espionaje presentarán una querella contra el CNI, Guardia Civil, Pegasus y Candiru

Aquí tenim els espies del PSOE

Round table organized by Sentinel Alliance on its presentation day, with the participation of Elies Campo (Citizen Lab), Joan Matamala (Fundació Nord), Jordi Solé (former ERC Member of the European Parliament), and Elisenda Paluzie (former president of the ANC), who was also spied on with NSO’s Pegasus spyware.

HBO Max Surveilled Film with Ronan Farrow

Journalist Ronan Farrow investigates the growing commercial spyware industry – and the ethical dilemmas of 21st century cyberespionage.

Josep Costa and Albano-Dante Fachin file complaint against Spanish authorities and NSO for spying on them with Pegasus

The former vice president of the Parliament and the former MP have each filed complaints in the Barcelona courts for breach of secrets and violation of civil rights.

The ANC files a lawsuit seeking protection over Pegasus and targets the CNI, Police, and Civil Guard.

The Catalan National Assembly (ANC) has filed a lawsuit before Investigative Court No. 32 of Barcelona, seeking judicial protection over the Pegasus spyware espionage. While the complaint is not formally directed against specific individuals or entities, it does point to “the Spanish State, law enforcement agencies — the Civil Guard and National Police — and the CNI [Spain’s intelligence agency] as possible perpetrators of these crimes.”

Interview Jordi Baylina - FAQs