Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

Carmine Tsunami

Carmine Tsunami is an Israel-attributed threat actor group, tracked by Brandefense.

Also known as
  • DEV-0196
  • QuaDream
Request IOC feedRequest ATT&CK export
Origin
Israel
Techniques
0
Exploited CVEs
No CVE data
Record updated

About Carmine Tsunami.

Carmine Tsunami is a threat actor linked to an Israel-based private sector offensive actor called QuaDream. QuaDream sells a platform called REIGN to governments for law enforcement purposes, which includes exploits, malware, and infrastructure for data exfiltration from mobile devices. Carmine Tsunami is associated with the iOS malware called KingsPawn and has targeted civil society victims, including journalists, political opposition figures, and NGO workers, in various regions. They utilize domain registrars and inexpensive cloud hosting providers, often using single domains per IP address and deploying free Let's Encrypt SSL certificates.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.