Paragon Spyware IPO: Graphite Maker Heads to Nasdaq via SPAC

Twenty months ago, WhatsApp said Paragon's Graphite spyware had targeted around 90 of its users, journalists and human rights workers among them. Now the same company is about to sit inside a stock you can buy from a brokerage app. REDLattice and a blank check company called Bold Eagle Acquisition Corp. signed a business combination agreement on September 25, and the proceeds will pay off the last installment owed for buying Paragon. For the reporters and activists who have spent two years asking who ordered Graphite infections, the question is whether a ticker symbol brings answers or just capital.

Key Takeaways

• REDLattice, which owns Paragon Solutions, agreed on September 25, 2026 to merge with Nasdaq listed Bold Eagle Acquisition Corp. at a $1.25 billion pre money enterprise value, with closing expected around year end 2026 under the ticker REDL.
• Paragon and REDLattice reported $267 million in combined revenue for the 12 months ending June 2026, up 29% year over year.
• The deal is expected to raise about $610 million, part of which will fund the final cash earnout for REDLattice's acquisition of Paragon Solutions Ltd.
• Paragon's Graphite was forensically confirmed by Citizen Lab on the iPhones of two European journalists in 2025, one of them Fanpage.it's Ciro Pellegrino.
• Cognyte, another Israeli surveillance vendor that Meta caught targeting journalists, has been on Nasdaq since 2021, so Paragon will not be the first surveillance firm with public shareholders.

Is Paragon Actually Having an IPO?

No, not in the traditional sense: Paragon is going public as part of REDLattice, which is merging with a special purpose acquisition company that already trades on Nasdaq as BEAG. The mechanics are laid out in Bold Eagle's Form 8-K filed with the SEC. Bold Eagle, a Cayman Islands shell, will redomicile in Delaware, and a merger subsidiary will fold into REDLattice, leaving REDLattice as a wholly owned subsidiary of the new public company.

Paragon's name does not appear in the 8-K at all. It shows up in the joint press release attached to the filing, which says the money will be used "to refinance all of REDLattice's existing debt and to fund the final cash earnout payment from the Company's previously consummated acquisition of Paragon Solutions Ltd." The key numbers:

• Valuation: $1.25 billion pre money enterprise value.
• Cash: about $610 million gross, from $335 million in committed capital plus about $275 million in Bold Eagle's trust, assuming no shareholder redemptions.
• Committed capital: $275 million in 4% convertible notes with a $12.50 conversion price, plus a $60 million common stock PIPE at $10 per share.
• Control: AE Industrial Partners stays the largest shareholder, and existing owners roll over 100% of their equity.
• Business: founded in 2012, more than 100 customers across 23 countries, a $200 million backlog.

Closing still needs a Bold Eagle shareholder vote, an effective S-4 registration statement, Nasdaq listing approval, regulatory clearances, and at least $100 million in cash equity, per the 8-K.

How Did an Israeli Spyware Firm End Up in a US SPAC?

Florida private equity firm AE Industrial Partners bought Paragon in December 2024 for a reported $500 million and merged it into REDLattice, a US company that sells what it calls "lawful intercept" tools to military, defense, and law enforcement agencies, according to The Record's report on the listing and SiliconANGLE. Ownership moved to the US. Engineering did not: Calcalist reports that Israel "will continue to serve as the combined company's hub for research, development and innovation."

The deal fits a pattern that researchers flagged a year ago. The Atlantic Council's Mythical Beasts report, published September 10, 2025, counted US based spyware investors rising from eleven to thirty one, making the United States the largest investor in its sample. It named AE Industrial's late 2024 investment in Paragon as one example. The SPAC takes that curve from private equity money to public market money.

REDLattice CEO Andy Boyd framed the listing as growth capital. The transaction "provides the capital and public market currency to accelerate our organic growth, expand our product portfolio and pursue disciplined M&A across adjacent mission-critical capabilities," he said in a statement quoted by The Record.

What Is Graphite, and Who Has It Hit?

Graphite is Paragon's flagship product, mobile spyware that can get inside messaging apps on a target's phone and pull out their contents. Its public track record comes almost entirely from forensic work on victims:

• January 2025: WhatsApp said Graphite had targeted approximately 90 users, including journalists and human rights workers, through a zero click attack it disrupted.
• March 19, 2025: Citizen Lab's first Paragon report mapped infrastructure pointing to suspected deployments in Australia, Canada, Cyprus, Denmark, Israel, and Singapore. REDLattice now says it serves customers in 23 countries.
• June 12, 2025: Citizen Lab confirmed with high confidence that Graphite targeted Fanpage.it journalist Ciro Pellegrino and a prominent European journalist through a zero click iMessage attack. Apple tracked the flaw as CVE-2025-43200 and says it was mitigated as of iOS 18.3.1.
• Italy: a parliamentary committee acknowledged that the government had used Paragon against activists Luca Casarini and Giuseppe Caccia, but said it could not determine who targeted Fanpage editor Francesco Cancellato. We covered how that investigation stalled.
• United States: ICE lifted a Biden era stop work order on its $2 million Paragon contract in August 2025. In May 2026, DHS said ICE had no relationship with Paragon but would not say whether it had moved to another vendor.

Will Going Public Make Paragon More Accountable?

Somewhat, but the precedent says disclosure will be thinner than critics hope. Jen Roberts of the Atlantic Council's Cyber Statecraft Initiative, a coauthor of Mythical Beasts, told The Record that "public companies face disclosure requirements, and shareholders gain real levers, from proxy votes to divestment, to shape how the company behaves." She also said that for policymakers trying to "curb proliferation of these capabilities, this isn't a good sign."

There is already a test case. Cognyte, the cyber intelligence business Verint spun off, has traded on Nasdaq as CGNT since February 1, 2021. Ten months after the listing, Meta's December 2021 surveillance for hire threat report said it removed about 100 accounts linked to Cognyte and its customers, whose targets "included journalists and politicians around the world."

What did public company disclosure produce afterward? A risk factor. Cognyte's 2025 annual report on Form 20-F warns that it has "experienced, and may continue to experience, reputational harm from negative publicity as a result of allegations regarding the misuse of our solutions." It does not name the customers. Expect REDLattice's S-4 to read the same way: revenue concentration, government customer risk, export controls, and no list of which agency infected which phone.

The more meaningful change is who now has a financial stake. NSO Group explored a Tel Aviv or Nasdaq listing at about $2 billion, including through a SPAC, Globes reported in January 2021. It never happened. Paragon is about to reach the market NSO could not, with mutual fund and institutional investors supplying $335 million in committed capital. Once index funds and pension managers hold REDL, shareholder proposals and divestment campaigns become real tools for civil society, but so does a large investor base that profits when government demand for Graphite grows.

What This Means for Your Inbox

Graphite's documented delivery routes are messaging apps: a WhatsApp zero click attack disrupted in early 2025 and a zero click iMessage exploit. But spyware that can read WhatsApp on your phone is sitting on the same device as your mail app, your password manager, and your synced Gmail. End to end encryption protects messages in transit. It does nothing once an operator reads them on the handset.

Email is also where the warning usually lands. Apple sends threat notifications to the email addresses on a target's Apple Account, and says a genuine alert will never ask you to click links, open files, or give up a password. That makes the notification itself a phishing template, so confirm any alert by signing in at account.apple.com directly. For background on who else is buying these tools, see our piece on the UK's warning that 100 countries can hack phones.

What Journalists and Activists Can Do Now

A listing does not change what Graphite can do, so the defenses are unchanged. Five concrete steps:

1. Turn on Lockdown Mode. On iPhone, go to Settings, then Privacy & Security, then Lockdown Mode. Apple says it blocks most message attachment types and disables link previews, the kind of attack surface zero click exploits use. Read Apple's claim about its track record before relying on it.
2. Enroll your Google account in Advanced Protection. Google's Advanced Protection Program requires a passkey or security key to sign in and restricts which third party apps can reach your Gmail and Drive.
3. Update immediately. The Graphite iMessage flaw was closed in iOS 18.3.1. Devices that lag behind stay exposed to already patched exploits.
4. Get a forensic check if you are notified. Access Now's Digital Security Helpline is free, runs 24/7 in ten languages, and aims to respond within two hours. Pellegrino got his confirmation because he contacted Citizen Lab after an Apple notification on April 29, 2025.
5. Watch the filings. Bold Eagle's SEC filings (CIK 0001852207) will carry the S-4 and proxy. Its risk factors, customer concentration data, and any export control disclosures are the most detail Paragon has ever had to publish.

Looking Ahead

Three dates matter. The S-4 filing will be the first time REDLattice describes its Paragon business under SEC liability. The Bold Eagle shareholder vote is where redemptions will show how much appetite public investors actually have for a spyware vendor. And the 180 day lockup after closing, described in the business combination filing, sets when AE Industrial and other insiders can start selling.

None of that answers the question Italian journalists have been asking since January 2025: who pointed Graphite at them. Shareholders can now ask it too, in writing, at an annual meeting. Whether REDLattice answers will say more about the value of public company accountability than any press release.