Threat actor
Zignal Labs
Last fetched
Zignal Labs is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
Zignal Labs is a San Francisco-based big data analytics company that develops real-time media monitoring and business intelligence tools. Founded by Josh Grinsberg, the company enables clients to monitor, analyze and organize data from social media and other online platforms. In partnership with Qorvis Communications, a long-standing lobbying firm for Saudi Arabia, Zignal Labs has been contracted to provide surveillance activities on behalf of the Royal Embassy of Saudi Arabia. In October 2025, it was revealed that ICE signed a $5.7 million contract for licenses to Zignal Labs' software. The platform is also utilized by the Israeli military and the Pentagon.
Techniques by tactic
No ATT&CK techniques are recorded for Zignal Labs in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to Zignal Labs today — this states the absence of a published link, not that Zignal Labs has no infrastructure.
References
- https://theintercept.com/2015/03/24/saudi-arabia-retains-gops-big-data-firm-advance-policy-agenda/
- https://www.washingtonpost.com/news/powerpost/wp/2016/04/20/saudi-government-has-vast-network-of-pr-lobby-firms-in-u-s/
- https://www.truthdig.com/articles/saudi-arabia-continues-hiring-spree-of-u-s-lobbyists-and-public-relations-experts/
- https://truthout.org/articles/ice-just-spent-millions-on-a-social-media-surveillance-ai-program/
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from Zignal Labs into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.