Loading threat actor…
Intellexa is an Israel-associated commercial surveillance consortium founded by Tal Dilian that supplies intrusion and surveillance capabilities to governments and other well-resourced customers. Greece has served as a central operational and training hub, with affiliated personnel also based in North Macedonia. Its principal product, Predator, was originally developed by the North Macedonian company Cytrox, which subsequently came under Intellexa's control. Predator has also been marketed as Helios, Nova, Green Arrow, and Red Arrow; these are product names rather than separate actor identities. Predator targets Android and iOS devices and has been used against journalists, human rights defenders, lawyers, opposition figures, government personnel, and businesspeople. Documented targeting includes a human rights lawyer in Pakistan, an Egyptian opposition activist, and a Greek journalist. Intellexa develops and purchases exploit chains, with at least 15 zero-day vulnerabilities linked to its activities since 2021. Its capabilities include browser exploitation, sandbox escape, and privilege escalation. Delivery methods include one-click messaging links, zero-click attacks, and network-based injection. The Aladdin delivery system abuses mobile advertising infrastructure to identify selected devices and redirect them to exploit servers without requiring an advertisement click. Predator can extract messages, emails, passwords, call information, location data, and screenshots, and remotely activate microphones and cameras. Its iOS implementation incorporates extensive anti-analysis and anti-forensics measures, including checks for Developer Mode, jailbreak artifacts, security tools, and network interception. It reports deployment failures to command-and-control infrastructure, removes forensic artifacts, and hooks SpringBoard to suppress recording indicators. Intellexa also retained remote-access capabilities into some customer surveillance systems, although this does not establish that it directly operated every deployment. Intellexa distributes its capabilities through a fragmented international corporate network, including front companies associated with advertising-based delivery. The consortium has continued operating despite U.S. sanctions imposed on affiliated entities and executives in 2024 and investigations in Greece.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families attributed to this actor across reporting.
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
Apple patched three vulnerabilities exploited in the wild on September 21, 2023, including “CVE-2023-41991 - Certificate validation issue (CoreTrust).” The CoreTrust vulnerability subsequently appeared in TrollStore v2.
CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 (Apple iOS) — Intellexa/Cytrox (Predator).
CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 (Apple iOS) — Intellexa/Cytrox (Predator).
CVE-2023-2033 (Google Chrome) — Intellexa/Cytrox (Predator).
CVE-2023-2136 (Google Chrome) — Intellexa/Cytrox (Predator).
1 more CVE tied to this actor tracked in Mallory.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as background to Discover-Tech’s corporate connections. Sara Hamou’s involvement and Eric Banoun’s connection to consortium member Senpai Technologies illustrate links to the wider spyware industry. The report does not establish Intellexa’s operational participation in the documented AdFection attacks.
Referenced as a prior example of a commercial spyware operator associated with Predator, cited in the context of exploit chains that start with browser UAF vulnerabilities and are chained with sandbox escapes.
Commercial spyware vendor described as owning Predator spyware and (per Jamf’s reverse engineering) potentially operating or tightly controlling standardized, vendor-managed C2/error-reporting infrastructure that collects detailed failure/anti-analysis telemetry from attempted infections to improve future deployments.
Intellexa is a commercial spyware vendor accused of accessing and potentially exposing data from government surveillance operations using its Predator spyware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.