Loading threat actor…
Cytrox is a commercial surveillance vendor associated with the Predator spyware platform. It is widely categorized as part of the mercenary spyware ecosystem rather than a traditional criminal or state-nexus intrusion set. Predator has been linked to covert mobile-device compromise, including exploit-chain-based deployment and highly intrusive surveillance of targets such as politicians, journalists, activists, dissidents, and other high-profile individuals. Reported capabilities associated with Predator include device compromise without obvious user awareness, access to sensitive communications, credential theft, keylogging, screenshot and notification capture, and broader data exfiltration from compromised smartphones, including encrypted messaging environments and cloud-linked access. Cytrox has been publicly identified in surveillance-industry tracking and threat-notification reporting alongside other prominent spyware vendors such as NSO Group. Its tooling has been associated with targeted surveillance operations affecting individuals in multiple countries, including the United States and the United Kingdom, as well as broader global targeting. Available information in this dataset supports characterization of Cytrox primarily as a surveillance and espionage-oriented commercial spyware provider, but does not provide high-confidence attribution to a specific country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
27 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cytrox is known for developing Predator spyware, which is deployed via sophisticated exploit chains to compromise mobile devices. Predator has been used in targeted surveillance campaigns, often attributed to nation-state customers, against high-profile individuals.
Cytrox is known for developing Predator spyware, used to monitor politicians, journalists, and activists globally.
Named as a newly added surveillance group in MISP Galaxy.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.