Overview
- Court-appointed experts found malware-consistent traces only on the Android phones of activists Giuseppe Caccia and Luca Casarini and journalist Francesco Cancellato.
- Analysts documented WhatsApp database anomalies on all three devices consistent with Meta’s descriptions of Paragon’s Graphite spyware.
- The intrusions were timed to 01:17, 02:20 and 03:43 on 14 December 2024, pointing to a single coordinated infection campaign.
- After an unprecedented access to AISI’s Graphite servers, logs confirmed operations targeting Caccia and Casarini but showed no activity attributable to Cancellato.
- The Rome and Naples probes, coordinated by the national anti-mafia directorate, continue against unknown suspects to determine authorship and assess any unlawful surveillance.