DarkMatter Group

DarkMatter Group is a cybersecurity and digital intelligence company founded in the United Arab Emirates in approximately 2014 or 2015 by Emirati entrepreneur Faisal al-Bannai, who had previously founded the mobile-phone retailer Axiom Telecom. The company presented itself publicly as a defensive technology provider focused on network security, bug sweeping, secure communications, and national cyber-defense capabilities. Its public launch took place in 2015 at the Arab Future Cities Summit, where it promoted services intended for governments, enterprises, and critical infrastructure. The company’s business expanded rapidly through close work with the UAE government and related institutions. By early 2018, reports described its turnover as reaching hundreds of millions of U.S. dollars, although no independently verified financial figures are provided here. Approximately 80 percent of its work was reportedly connected to the UAE government and affiliated organizations, including the National Electronic Security Authority. DarkMatter also recruited internationally, including engineers in Oulu, Finland, and personnel with backgrounds in the United States National Security Agency, the U.S. military, Israeli military technology units, and competing contractors. DarkMatter became internationally controversial after it replaced CyberPoint as a contractor for Project Raven in 2016. Project Raven was a secret UAE-linked cyber-intelligence operation in which former U.S. intelligence personnel reportedly conducted computer and mobile-phone intrusions against foreign governments, political figures, activists, journalists, and other targets. Reporting connected DarkMatter personnel to the operation and alleged that its activities extended beyond defensive cybersecurity into offensive surveillance. DarkMatter and former employees disputed some of the allegations, describing the work as assistance in building a UAE national cybersecurity capability and asserting that lawful targeting procedures were part of the mission. The company also developed the Katim secure smartphone, whose name means “silent” in Arabic. Katim was marketed as a secure communications device, and the associated communications system was later distributed by Digital14 after DarkMatter’s cyber activities had reportedly been transferred there by 2021. DarkMatter was named an official provider for Expo 2020 but was subsequently replaced by another company. A separate controversy concerned DarkMatter’s attempt to become a trusted certificate authority for Mozilla Firefox. Security researchers and whistleblowers warned that such status could give the company the ability to issue certificates capable of impersonating legitimate websites or software services. Mozilla reviewed the application for more than a year and rejected it in July 2019 after considering technical and trust-related concerns, including reporting about Project Raven. Google subsequently took steps against websites certified by DarkMatter, according to reporting cited in the company’s Wikipedia article. The company and people associated with its operations also became subjects of U.S. investigations and legal proceedings. In 2021, three former U.S. intelligence or military personnel—Marc Baier, Ryan Adams, and Daniel Gericke—were indicted over computer-related and export-control violations connected to their work for the UAE-linked operation. They entered deferred-prosecution arrangements, paid a combined $1.68 million in fines, relinquished security clearances, agreed to cooperate with U.S. investigations, and accepted restrictions on future work involving certain defense and cyber-exploitation activities. DarkMatter’s current corporate status, ownership, and operating structure are unclear from the available reference material.

DarkMatter Group emerged in the United Arab Emirates during the mid-2010s, founded by Faisal al-Bannai, an Emirati businessman known for establishing Axiom Telecom. The available reference material gives conflicting information about whether the company was founded in 2014 or 2015. A wholly owned subsidiary called Zeline 1 became active in Finland around 2014, where the group later sought engineering and smartphone-development expertise. DarkMatter made its public debut in 2015 at the second Arab Future Cities Summit. Its initial public proposition centered on network security, electronic security testing, bug sweeping, and the development of a secure mobile handset. The company described itself as a digital defense and intelligence provider for the UAE, presenting its work as part of the country’s effort to establish sovereign cybersecurity and communications capabilities. The company’s government-facing business grew quickly. By early 2018, reporting described annual turnover in the hundreds of millions of U.S. dollars and stated that most of its work came from UAE government bodies and associated organizations, including the National Electronic Security Authority. DarkMatter recruited through trade shows, referrals, and direct approaches to specialists. Its reported workforce included former U.S. intelligence employees, personnel from U.S. military and intelligence communities, graduates of Israeli military technology units, and engineers recruited in Finland. Some recruitment practices were criticized as unusually opaque, particularly where prospective employees were given limited information about the work before being asked to engage. DarkMatter’s most consequential connection was Project Raven, a clandestine cyber-intelligence program linked to UAE interests. The project used former U.S. intelligence personnel to conduct or support intrusions into phones and computers belonging to governments, political figures, activists, journalists, and other individuals. CyberPoint had supplied contractors to the program before DarkMatter became the principal contractor in 2016. Reporting said DarkMatter recruited or transferred several CyberPoint employees and that the operation’s scope expanded during the transition. DarkMatter publicly characterized itself as defensive, while former employees and investigative reports offered competing accounts of the nature and legality of the work. One tool associated with Project Raven was Karma, reportedly acquired in 2016. Karma exploited Apple iPhones remotely when operators possessed an identifying account detail such as a phone number, email address, or Apple ID. The tool was reported to provide access to communications, photos, passwords, and location data. Targets described in reporting included political leaders, activists, journalists, and officials in the Middle East and elsewhere. Apple later patched some of the vulnerabilities that reduced Karma’s effectiveness. DarkMatter also developed Katim, a secure smartphone whose name refers to silence in Arabic. Katim was promoted as a secure communications product for sensitive users. DarkMatter was listed as an official Expo 2020 provider but was later replaced. By 2021, the company’s cyber activities had reportedly been transferred to Digital14, which continued distributing the Katim secure communications system. The available sources do not establish whether DarkMatter itself remains active, has been dissolved, or has been fully absorbed into another structure. The group’s attempted entry into the public certificate-authority ecosystem created a second major controversy. DarkMatter applied to Mozilla in December 2017 to become a trusted certificate authority for Firefox. Researchers and whistleblowers warned that a trusted certificate authority could issue certificates that impersonate legitimate websites or facilitate interception of encrypted communications if misused. Mozilla examined the application and considered both technical compliance and broader trust concerns. After investigative reporting in 2019 connected DarkMatter personnel to Project Raven, the Electronic Frontier Foundation and others opposed the application. Mozilla rejected it in July 2019, and Google subsequently acted against websites certified by DarkMatter. U.S. investigations and litigation further intensified scrutiny. The FBI investigated alleged digital espionage services and other conduct associated with DarkMatter and UAE-linked operations. In September 2021, former operatives Marc Baier, Ryan Adams, and Daniel Gericke were indicted for alleged computer fraud and improper export of technology. Their deferred-prosecution agreements required monetary penalties totaling $1.68 million, cooperation with U.S. investigations, severance of certain UAE ties, surrender of security clearances, and restrictions on future work involving controlled defense articles and computer-network exploitation. In a separate 2021 lawsuit, Loujain al-Hathloul alleged that former operatives working for DarkMatter helped extract data from her iPhone, linking the alleged hacking to her detention. The legal and investigative record has made DarkMatter a prominent example in debates about commercial cyber operations, state-backed surveillance, dual-use security technologies, and the risks posed by former intelligence personnel working for foreign entities.

1. 2021Cyber activities reportedly shifted to Digital14

   Reporting stated that DarkMatter’s cyber activities had been transferred to Digital14, which distributed the Katim secure communications system.

   Source
2. 2021Former operatives entered deferred-prosecution agreements

   Three former operatives associated with DarkMatter-linked work accepted financial penalties and extensive restrictions in a U.S. criminal matter.

   Source
3. 2020U.S. congressional cybersecurity legislation

   Congress passed legislation requiring annual assessment of national-security risks posed by U.S. nationals working for foreign-based firms, governments, or entities; the measure was partly motivated by UAE-linked cyber operations.

   Source
4. 2019Mozilla rejected the certificate-authority application

   Mozilla rejected DarkMatter’s request for trusted Firefox certificate-authority status after public review and concerns about trustworthiness.

   Source
5. 2018Government work dominated reported business

   Reporting described hundreds of millions of dollars in turnover and said that most of the company’s work was for UAE government bodies and related organizations.

   Source
6. 2017Application to become a trusted certificate authority

   DarkMatter applied to Mozilla for inclusion as a trusted certificate authority in Firefox.

   Source
7. 2016DarkMatter became a Project Raven contractor

   DarkMatter replaced CyberPoint as the reported contractor for the UAE-linked Project Raven operation.

   Source
8. 2016Karma was reportedly acquired

   Project Raven reportedly obtained Karma, a tool capable of remotely compromising certain Apple iPhones.

   Source
9. 2015Public launch at the Arab Future Cities Summit

   DarkMatter publicly presented its network-security, bug-sweeping, digital-defense, and secure-handset ambitions at the second Arab Future Cities Summit.

   Source
10. 2014DarkMatter’s Finnish subsidiary became active

    Zeline 1, described as a wholly owned DarkMatter subsidiary, became active in Finland around this period.

    Source

DarkMatter positioned itself as a UAE-based provider of defensive cybersecurity, secure communications, and national digital-defense capabilities. Public reporting also associated the company with offensive cyber-intelligence and surveillance work conducted for UAE government interests, creating a gap between its defensive public positioning and the allegations surrounding Project Raven.

• KatimSecure smartphone and communications system

  Katim was DarkMatter’s secure mobile-phone initiative, with a name derived from an Arabic word meaning “silent.” It was intended for users requiring protected communications and was presented as part of the company’s broader sovereign-security offering. The associated secure communications system was later distributed by Digital14 after DarkMatter’s cyber activities reportedly moved to that organization.

• Network security and bug-sweeping servicesCybersecurity services2015

  At its public launch, DarkMatter promoted network-security work, electronic bug sweeping, and related protective services. These offerings were aimed particularly at government, urban-infrastructure, and sensitive enterprise environments, supporting the company’s public image as a defensive digital-security provider.

• KarmaCyber-intelligence exploitation tool2016

  Karma was reportedly a remote exploitation tool used by Project Raven. It could compromise certain Apple iPhones without requiring the owner to click a link or take another action, provided operators had an identifying detail such as a phone number, email address, or Apple ID. Reports said the tool enabled access to messages, photographs, passwords, email, and location information before Apple mitigated relevant vulnerabilities.

• 2020Expo 2020 technology-provider role

  United Arab Emirates

  DarkMatter was designated an official provider for Expo 2020, associating the company with a major international event hosted in the UAE.

  Outcome. The company was later dropped in favor of another provider.

  Source
• 2015Arab Future Cities Summit launch

  United Arab Emirates · Middle East

  DarkMatter used the second Arab Future Cities Summit to introduce its brand publicly and promote network security, bug sweeping, digital-defense services, and a planned secure smartphone.

  Outcome. The launch established the company’s public positioning as a UAE-centered provider of national cybersecurity and secure communications.

  Source

• 2021Transfer of cyber activities to Digital14Strategy

  By 2021, DarkMatter’s corporate status and operating structure had become difficult to distinguish from related UAE cybersecurity entities.

  What changed. The company’s cyber activities were reportedly transferred to Digital14, which continued distributing the Katim secure communications system.

  Aftermath. Digital14 became the reported distributor of Katim, while the available material does not establish whether DarkMatter itself remained active.

  Source
• 2017Application for trusted certificate-authority statusOther

  DarkMatter sought to expand from cybersecurity services into browser-trusted internet infrastructure.

  What changed. The company asked Mozilla to include it as a trusted certificate authority in Firefox.

  Aftermath. Mozilla rejected the request in 2019 following technical review, public consultation, and concerns raised by reporting and civil-society groups.

  Source
• 2016Shift from public defensive cybersecurity to a broader government-intelligence roleStrategy

  DarkMatter publicly described itself as a defensive cybersecurity company, but the UAE reportedly sought a local replacement for CyberPoint in Project Raven.

  What changed. DarkMatter assumed the reported Project Raven contractor role and recruited personnel with U.S. intelligence and military backgrounds.

  Aftermath. The transition became the basis for extensive reporting and later legal scrutiny concerning alleged surveillance of activists, journalists, governments, and other targets.

  Source

• 2021U.S. criminal case involving former operativesControversy

  Three former operatives linked to DarkMatter-associated work were indicted for alleged computer fraud and improper technology exports and entered deferred-prosecution agreements.

  Source
• 2021Loujain al-Hathloul lawsuitControversy

  Loujain al-Hathloul filed a U.S. lawsuit alleging that former intelligence and military personnel working for DarkMatter helped extract information from her iPhone, contributing to her arrest and subsequent detention.

  Source
• 2019Mozilla rejection and browser trust actionsControversy

  Mozilla rejected DarkMatter’s trusted-certificate application, while Google reportedly blocked or flagged sites using DarkMatter-issued certificates after investigative reporting about Project Raven.

  Source
• 2017Certificate-authority trust controversyControversy

  Researchers and whistleblowers objected to DarkMatter’s attempt to become a trusted certificate authority, warning that the capability could be abused to impersonate websites or intercept encrypted traffic.

  Source
• 2016Project Raven surveillance allegationsControversy

  DarkMatter reportedly replaced CyberPoint as contractor for Project Raven, a UAE-linked operation alleged to have used former U.S. intelligence personnel to hack governments, activists, journalists, and other targets.

  Source

• 2017DarkMatter sought recognition as a trusted Firefox certificate authority

  DarkMatter applied to Mozilla for trusted certificate-authority status, prompting extended technical and trust reviews.

  RegulationOther
  Source

1. DarkMatter Group