Threat actor
ShadowDragon
Last fetched
ShadowDragon is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
ShadowDragon is a company that develops surveillance software that can identify aliases and collect personal data from various online sources in minutes. It is known to be used by the Polk County Sheriff's Department in Des Moines, Iowa as well as Michigan police departments, the Massachusetts State Police and other police departments throughout the U.S. It is also a contractor for the US government, including for the Immigration and Customs Enforcement (ICE.) Its SocialNet tool enables government agencies to access and analyze publicly available data from over 200 websites, apps, and social networks. These include major platforms like Meta (Facebook, Instagram, Threads), TikTok, Telegram, Bluesky, Discord, and niche sites such as BeReal, FetLife, and Chess.com. SocialNet allows clients to input various identifiers (e.g., email, alias, or phone number) to uncover connections, map activities, and track individuals' digital footprints. The tool is marketed as capable of identifying relationships, interests, and physical locations. Its other products include OIMonitor, MalNet, Spotter, and Horizon.
Techniques by tactic
No ATT&CK techniques are recorded for ShadowDragon in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to ShadowDragon today — this states the absence of a published link, not that ShadowDragon has no infrastructure.
References
- https://jacobin.com/2023/09/shadowdragon-osint-internet-surveillance-ice-us-government
- https://theintercept.com/2021/09/21/surveillance-social-media-police-microsoft-shadowdragon-kaseware/
- https://www.axios.com/local/des-moines/2024/04/17/surveillance-social-media-sheriff-polk-shadowdragon
- https://www.nbcboston.com/investigations/shadowdragon-mass-police-get-new-social-media-monitoring-tool/2424128/
- https://www.criminallegalnews.org/news/2021/nov/15/shadowdragon-inside-social-media-surveillance-software-can-watch-your-every-move/
- https://nysfocus.com/2023/01/13/state-police-social-media-surveillance-including-dataminr-shadowdragon-geofeedia
- https://www.404media.co/the-200-sites-an-ice-surveillance-contractor-is-monitoring/
- https://www.404media.co/mozilla-foundation-calls-on-tech-industry-to-block-ice-contractor/
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from ShadowDragon into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.