Carmine Tsunami

Executive Summary

Carmine Tsunami (DEV-0196, QuaDream) is a threat actor linked to an Israel-based private sector offensive actor known as Qua Dream. They are associated with the iOS malware KingsPawn and have targeted civil society actors in various regions. Their operations include mobile device exploitation, domain registrar abuse, and use of cloud hosting infrastructure.

Goals & Targeting

Carmine Tsunami appears to target civil society actors, including journalists,政治 opposition figures, and NGO workers, likely with the intent of conducting surveillance or intelligence gathering. Their focus on these sectors suggests a potential interest in monitoring dissidents or activists. The actor's targeting extends across multiple regions, indicating either widespread geographic interests or specific operational objectives.

Carmine Tsunami is a cyber threat actor tied to QuaDream, an Israeli private sector entity that develops surveillance tools like the REIGN platform for government and law enforcement purposes. The group specializes in iOS malware, notably the KingsPawn strain, which targets mobile devices. Their primary victims have included journalists, political figures, and NGO workers across regions. Carmine Tsunami is known to use domain registrars and inexpensive cloud hosting services for their infrastructure, frequently deploying free Let's Encrypt SSL certificates to mask malicious activities.

Key Capabilities

• iOS malware development
• Mobile device exploitation
• Use of domain registrars and cloud hosting
• Data exfiltration techniques
• Spear-phishing campaigns

Software / Tooling

Campaigns & Victims

Carmine Tsunami's operations involve targeting civil society actors in multiple regions. While specific campaigns are not well-documented, the group's focus on mobile device exploitation and surveillance suggests a long-term operational strategy. Their use of domain registrars and cloud hosting indicates careful planning to evade detection.

IOC Patterns

• Spear-phishing with links to malicious domains
• Malicious iOS app distribution
• Use of Let's Encrypt SSL certificates
• Infrastructure hosted on disposable or low-cost cloud services

Recommended Actions

• Implement mobile device security monitoring for signs of malware activity.
• Monitor for suspicious domain registrations and associated network traffic.
• Enhance email filtering to detect phishing attempts targeting civil society actors.
• Conduct regular audits of cloud service usage for unauthorized or potentially malicious activities.

Suggested Tags