Loading story…
SentinelOne published research on the commercial surveillance vendors Intellexa and Cytrox, describing how their tooling evolved from earlier capabilities into spyware assessed as reaching intelligence-agency-grade sophistication. The report highlights the maturation of the vendors’ offensive surveillance ecosystem and frames their malware development as part of the broader mercenary spyware market.
The findings were presented through a LABSCon Replay briefing and focus on the technical progression and operational significance of the spyware platforms associated with the two companies. The publication adds to ongoing scrutiny of commercial spyware providers whose tools are marketed for covert monitoring and intrusion operations against targeted devices and users.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
At LABSCon 2023, Cisco Talos researchers Vitor Ventura and Michael Gentile presented research on how Intellexa emerged from Nexa Technologies, WiSpear, and Cytrox and developed the ALIEN/PREDATOR spyware suite into an agency-grade capability targeting iOS and Android.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have uncovered continued deployment of the Predator spyware, developed by Intellexa, in multiple countries despite U.S. sanctions and increased scrutiny. New evidence indicates active use in Iraq, with additional operations linked to entities in Pakistan, Saudi Arabia, Kazakhstan, Angola, and Mongolia. Some countries, such as Egypt, Botswana, and Trinidad and Tobago, appear to have ceased communication with Intellexa, though this may reflect changes in infrastructure rather than a halt in activity. The spyware has been used against civil society members, business executives, and other high-value targets, with its costly licensing model suggesting a focus on strategic individuals. Ongoing legal proceedings against former Intellexa executives in Greece highlight the international concern over the company's activities. Recorded Future’s Insikt Group has mapped a complex global network of individuals and entities associated with Intellexa, including those involved in backend development, infrastructure setup, and product distribution. Export and import data reveal that Intellexa’s products have been shipped to clients in various regions, with new evidence of product imports in Kazakhstan and the Philippines. The network also includes entities in the advertising sector potentially linked to the "Aladdin" ad-based infection vector. The persistent and likely unlawful use of Predator spyware continues to pose significant privacy, legal, and physical security risks, particularly for political opposition, business leaders, and individuals in sensitive roles worldwide.
Jun 29, 2026
Investigations by Amnesty International, media partners, and other researchers linked the **Predator** mercenary spyware ecosystem to campaigns targeting politicians, journalists, civil society figures, and officials across multiple countries. One probe found suspected Vietnamese government-linked operators used malicious X posts and fake news links in an attempt to infect the phones of U.S. lawmakers and journalists, including members of Congress and reporters covering national security and Taiwan. Separate reporting tied Predator to earlier abuses in Greece and elsewhere, while technical analysis showed the malware could exploit multiple zero-days, pair with the **Alien** component for persistence, and steal messages, record calls, and activate device microphones. The widening scandal triggered government action and court cases against the spyware network behind Predator. The United States blacklisted Intellexa and Cytrox and later imposed additional sanctions on Intellexa, citing national security risks from the commercial surveillance trade. In Greece, courts convicted executives in the Predator wiretapping case, including an Israeli spyware maker who received an eight-year sentence, while Amnesty continued to document new alleged targeting, including a journalist in Angola and further evidence from the **"Intellexa Leaks"** that the spyware industry remained active despite mounting scrutiny.
Jun 29, 2026
A SentinelOne LABScon presentation detailed the rise of a prolific cyber espionage actor that evolved over roughly a decade from phishing campaigns and broad malware distribution into a mature, persistent intrusion operation. The actor initially relied on malware such as **PlugX** and **ShadowPad**, then shifted toward more tightly controlled tools including **Crosswalk**, **Sidewalk**, **FunnySwitch**, **Spider**, and the **ScatterBee** loader as its tradecraft became more selective and sophisticated. The presentation said the actor has conducted operations across more than 35 countries and targeted multiple sectors, including government and telecommunications. Researchers highlighted **ShadowPad** as a key component of the ecosystem, noting that the malware has been used by at least 13 distinct threat actors since emerging around 2015, while a new variant found in August 2022 showed continued innovation in execution techniques; the actor also maintained layered infrastructure using relay networks, VPS systems, and tunneling to preserve access and conceal activity.
Jun 29, 2026