Cellebrite Acquires Corellium for $200M: A Game-Changer in iPhone Forensics

Cellebrite spent $200M on the hacking company Apple once sued - 9to5Mac

Cellebrite, the Israeli firm responsible for one of the world's most famous iPhone hacking tools, has acquired Corellium, the company best known for creating virtual iPhones used in security research. This is huge news. Today's $200 million deal brings together two powerful (and controversial) forces in the mobile forensics world, and is likely to make Apple's challenge of locking down iOS even harder. Corellium's platform has long been used by white-hat hackers and researchers to test iOS exploits without needing physical hardware. It was so effective that Apple once sued to shut it down, arguing that virtualizing iOS posed a security risk and copyright infringement. In 2020, the lawsuit failed after the court ruled that Corellium's use of iOS constituted fair use. Apple later appealed, and lost again before confidentially settling the dispute. Now, Corellium's capabilities are going straight into the hands of Cellebrite, whose extraction tools are already used by police agencies around the world, including ICE. The combined company says it's working on a new product called Mirror, which Forbe says will: "Enable police to make a virtual version of a seized device and all the data that's on it. Wade thinks it'll help prosecutors show a jury exactly what's on a criminal's phone, presenting more compelling evidence compared to screenshots from technical-looking forensic tools." Corellium's founder, Chris Wade, who was pardoned by Donald Trump for unrelated cybercrime charges, is now Cellebrite's CTO. He says the combined tools could also help detect spyware by using AI to spot "foreign code" running inside a virtual OS, a move that could appeal to both law enforcement and cybersecurity researchers. While Apple has come around on virtualization since its early battles with Corellium, now even offering native APIs for it, today's news reframes the fight. The question is no longer whether iOS should allow for virtualization, but rather how useless Apple can render physical access to its devices.

Cellebrite acquires iPhone virtualization firm Corellium for $200M

Cellebrite has acquired virtualization firm Corellium for $200M. Cellebrite, an Israeli cybersecurity firm known for assisting law enforcement in unlocking iPhones, has acquired the virtualization-focused startup Corellium for $200 million. The two already have plans for a new digital forensics product. Cellebrite and Corellium are two of the most prominent names in the area of iOS forensics and analysis, and now they're going to be part of a singular entity that could make iPhone data extraction easier than ever before. While Cellebrite's extensive work with law enforcement over the years involved specialized hardware that the company attempted to keep hidden, its acquisition of Corellium is expected to result in a new software-based tool that utilizes virtualization. According to a Forbes report on Thursday, the two companies plan to release a new product dubbed "Mirror." As its name implies, the tool will allow law enforcement agencies to create a virtual version of a seized iPhone, from which relevant data can then be extracted. This approach would represent an improvement over Cellebrite's existing offerings, which are unable to process and retrieve data from certain applications, the report claims. Corellium's founder, Chris Wade, believes Mirror will be used to help juries see the exact contents of a defendant's phone, rather than just technical screenshots from forensic software. Corellium and Cellebrite also plan to use AI to detect "deviations or any execution of foreign code" on iPhones. This would be useful for the detection of state-sponsored spyware, but it may also be appealing to law enforcement agencies. U.S. Immigration and Customs Enforcement (ICE) is one of Cellebrite's largest customers, as the two signed a $9.6 million deal in August 2024. The company seemingly didn't want Corellium to achieve anything similar, but their attempt to stop it from happening was largely unsuccessful. The virtualization company's founder, Chris Wade, is now its Chief Technology Officer. Wade was pardoned by the Trump administration for unrelated cybercrime charges, as he assisted the United States government, specifically the Department of Justice and the FBI. While the results of Cellebrite's acquisition of Corellium have yet to be seen, it could ultimately reduce the need for physical device access in data retrieval and analysis endeavors. Apple won't stop releasing new security measures, either, though.