Skip to content
Ransomware group

DarkMatter

DarkMatter is a UAE- or Abu Dhabi-based cybersecurity and security firm, also referred to as DarkMatter Group or DarkMatter LLC in the provided content.

Profile source: Mallory opens in a new tab

DarkMatter

Family profile

DarkMatter is a UAE- or Abu Dhabi-based cybersecurity and security firm, also referred to as DarkMatter Group or DarkMatter LLC in the provided content. It is described as an Emirati cybersecurity company that publicly presented itself as focused on defensive security, PKI, secure communications, encryption, countersurveillance, network defense, and safeguarding complex organizations. The content also states that DarkMatter sought inclusion as a trusted root certificate authority in Firefox and said it operated UAE Global Root CAs under joint stewardship with the UAE government as part of the UAE National PKI. DarkMatter is described as well-funded, as having hired personnel from major technology companies and former U.S. intelligence and security personnel, including former CIA, NSA, and other U.S. intelligence community veterans, and as having recruited significantly from CyberPoint. The content links senior figures including Faisal Al Bannai as CEO in one account, Karim Sabbagh as CEO in another, and notes that Peng Xiao previously ran DarkMatter’s Pegasus division before later leading G42. Security-relevant reporting in the content repeatedly associates DarkMatter with offensive cyber and surveillance activity on behalf of the UAE. Reuters reporting cited in the content says Project Raven, a UAE offensive cyber unit staffed in part by former American intelligence operatives, was paid through DarkMatter and used the Karma zero-click iPhone exploit in 2016 and 2017 against activists, diplomats, rival foreign leaders, journalists, dissidents, and in some accounts U.S. citizens and officials. The content also states that three former NSA employees who worked for DarkMatter between 2016 and 2019 entered a U.S. Department of Justice deferred prosecution agreement for export-control violations tied to developing and deploying hacking tools for the UAE. Additional reporting in the content links DarkMatter to surveillance of human rights activists, scrutiny over hiring former CIA and NSA staffers, concern over its certificate authority ambitions, and allegations that it was deeply connected to the UAE intelligence apparatus. The content also notes that DarkMatter later went defunct or 'went belly up,' though no precise closure details are provided.

Ransomware.live

Operational record

View group record ↗

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.