Loading story…
Human Rights Watch reported that Bulgaria granted export licenses from 2018 to 2023 to Circles, a surveillance technology firm, allowing it to sell phone-monitoring systems to law enforcement and intelligence agencies in multiple countries accused of repression. The licensed products reportedly included Pixcell, Landmark, and Voice Over Location Enabler, tools capable of capturing internet data, intercepting calls and messages, and geolocating phones in real time.
The findings have intensified scrutiny of the European Union’s dual-use export control regime, which is meant to limit transfers of surveillance technology that could enable human rights abuses. Human Rights Watch said the case exposed weak human rights due diligence and poor enforcement by EU governments, while the European Commission said export licensing decisions rest with member states. Circles has also drawn attention because co-founder Tal Dilian has been linked to the blacklisted spyware firm Intellexa and was convicted by a Greek court in a case involving surveillance of journalists, politicians, and civil society members.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Human Rights Watch published findings that Circles sold phone surveillance tools to agencies in repressive states and said the case exposed weaknesses in the EU export control regime for sensitive surveillance technology.
The Record reports that Tal Dilian, linked to Intellexa and a co-founder of Circles, was found guilty by a Greek court in February in a case involving the surveillance of journalists, politicians, and civil society members.
Human Rights Watch reported that Bulgaria issued export licenses to Circles between 2018 and 2023, allowing the company to sell surveillance systems to law enforcement and intelligence agencies in multiple countries with records of repression.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
bloomberg.com
Open sourcetherecord.media
Open sourcehrw.org
Open sourcecitizenlab.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cellebrite said it has suspended the use of some of its digital forensic products by certain customers in Serbia after Amnesty International reported that Serbian police and intelligence services allegedly used the technology to unlawfully extract data from the phones of activists and journalists. Amnesty said its December 2024 investigation found that authorities used mobile device extraction tools outside legally sanctioned procedures and, in some cases, that targeted phones were later infected with spyware. The dispute has intensified scrutiny of Serbia’s treatment of civil society and independent media, with Amnesty arguing that the surveillance activity occurred amid anti-government protests and a broader pattern of pressure on government critics. Amnesty welcomed Cellebrite’s move but called on the company to strengthen human-rights due diligence and urged a halt to exports of surveillance and digital forensics technology to Serbia until effective independent oversight is in place.
Jul 24, 2026
Members of the European Parliament (MEPs) have raised urgent concerns regarding the allocation of European Union funds to companies that develop commercial spyware. A coalition of 39 MEPs has formally demanded explanations from senior European Commission officials after investigative reports revealed that millions of euros in EU subsidies have been directed to spyware vendors. These companies, including Intellexa, Cy4Gate, Verint, and Cognyte, have been linked to unlawful surveillance activities targeting journalists, human rights defenders, and political figures both within the EU and in countries with poor human rights records. The MEPs' letter specifically references findings from the investigative outlet Follow the Money, which documented how state-owned entities and EU programs, such as the European Defense Fund and Horizon 2020, have provided substantial financial support to these firms. For instance, Cy4Gate reportedly received at least €3.8 million from EU sources over a four-year period ending in 2024, with the company claiming the funds were for research and development in cybersecurity technologies for both civilian and defense applications. Additional funding examples include €1.3 million from Spain’s public Centre for the Development Of Industrial Technology to Mollitiam Industries, and €1.74 million from Horizon 2020 to projects involving Innova, a supplier of surveillance tools to Italian prosecutors. The European Regional Development Fund and the European Social Fund also contributed to Innova and Movia, the latter developing the Spider spyware. The MEPs argue that these funding practices raise serious questions about the governance, transparency, and accountability of EU financial mechanisms. They highlight the contradiction between the EU’s stated commitment to democracy and human rights and its indirect support for technologies that undermine these values. The letter was addressed to key European Commission officials responsible for technology, democracy, and budget oversight, demanding a thorough review and immediate action to prevent further subsidization of spyware companies. The issue has gained urgency as several MEPs have themselves been targeted by mercenary spyware, prompting the European Parliament to implement proactive device checks for its members. The controversy follows a series of scandals in countries such as Italy, Greece, Poland, Hungary, and Spain, where spyware has been used in politically sensitive surveillance operations. The MEPs also referenced recommendations from the PEGA inquiry, which previously called for stricter controls on surveillance technology. The ongoing revelations have intensified calls for greater oversight and reform of EU funding programs to ensure they do not enable the erosion of fundamental rights. The situation underscores the complex intersection of technology development, public funding, and civil liberties within the European Union. The European Commission is now under significant pressure to clarify its position and implement safeguards against the misuse of EU resources. The debate is expected to continue as more details emerge about the extent of EU involvement in supporting the spyware industry. The outcome of this inquiry could have far-reaching implications for EU policy on technology, security, and human rights.
Jun 29, 2026
A Greek court in Athens sentenced **Intellexa** founder **Tal Dilian** and three associates—**Sara Hamou**, **Felix Bitzios**, and **Yiannis Lavranos**—to prison for their roles in the “Greek Watergate” spyware scandal involving illegal wiretapping and privacy violations tied to Intellexa’s *Predator* spyware. Local reporting cited by multiple outlets indicates the court imposed sentences totaling more than **126 years**, which under Greek law translate to **eight years** to be served; the court also ordered further investigation, and the defendants are expected to **appeal** and remain free pending the appeal process. The case stems from allegations that *Predator* was used to surveil Greek targets including **politicians, journalists, businesspeople, military officials, and other public figures**, with reporting citing **more than 90** victims in Greece during **2020–2021**. Lavranos’s company **Krikel** was reported to have links to the procurement of *Predator*. The convictions mark a notable legal milestone against a commercial spyware vendor; Intellexa and associated entities have also faced international scrutiny, including **U.S. sanctions** in 2024 over alleged misuse of the spyware, and experts noted the guilty verdict and custodial sentence could increase cross-border legal exposure even if defendants attempt to avoid Greek jurisdiction.
Jun 29, 2026