So, the Greek government is illegally monitoring its citizens' devices through predator spyware and no one seems to be doing anything about it. ARE PRIVATE COMPANIES ACTING UNCHECKED WITHOUT A LEGISLATIVE FRAMEWORK?
Predator spyware is, according to reports on foreign websites, the new spying tool of the Greek government towards its citizens. This is the conclusion we reach after reading the recent research by CitizenLab, a group of researchers and security experts from Canada. Predator spyware is believed to have been built for a very specific purpose: itsuse by government authorities and law enforcement authorities to spy on unsuspecting citizens, worldwide.
Among the governments allegedly using the spying tool is Greece, according to research by CitizenLab and Meta (Facebook). However, Greece's relationship with the spyware appears to be more complex and deep than it might seem at first glance.
Predator spyware was developed by Cytrox , a company associated with Cyprus and Greece. The spyware has caught the attention of security experts worldwide for its illegal activity against high-profile figures, such as the recent hacking of the devices of Ayman Nour, a member of the Egyptian political opposition living in exile in Turkey, and an Egyptian journalist who hosts a popular news program, whose identity remains anonymous.
The dangerous spyware, behind which the now "infamous" Cytrox is located, in the wrong hands, can cause great harm to its victims, something that the CitizenLab research team from Canada realized in time and carried out a relevant forensics analysis on devices of victims of this surveillance software.
The security experts' analysis was released on December 16, 2021 , but most of the world's media outlets seem to have deliberately suppressed the news, while the Greek media did not consider the possible connection of the spyware to Greek authorities important enough to report. To become clearer and better understand the Predator spyware and Cytrox case, let's analyze their connection.
Cytrox: A company full of surprises behind Predator spyware
Founded in 2017, Cytrox’s business is described as providing “operational cyber solutions” to governments, and includes collecting information from devices and cloud services. Furthermore, their technology is defined as “cyber-intelligence systemsdesigned to provide security” to governments and to help “plan, manage, and implement cyber intelligence collection across the network, enabling businesses to collect information from both end devices and cloud services.” So the company built the spyware to serve the needs of governments.
Cytrox reportedly began life as a start-up in North Macedonia. A review of corporate registry documents shows that Cytrox appears to have a corporate presence in Israel and Hungary. Cytrox’s Israeli companies were founded in 2017 as Cytrox EMEA Ltd. and Cytrox Software Ltd. Both of these companies were renamed in 2019 to Balinese Ltd. and Peterbald Ltd., respectively. A corporate entity in Hungary, Cytrox Holdings Zrt, was also observed, which was also founded in 2017.
As of this writing, the CEO of Cytrox is Ivo Malinkovski, as listed on his LinkedIn page.
A 2019 report in Forbes notes that Cytrox was “saved” by Tal Dilian, a former military commander of Israel Defense Forces (IDF) Unit 81, whose private company—WiSpear (which appears to have been renamed Passitora Ltd.)—is based in Limassol, Cyprus, and reportedly acquired Cytrox in 2018. Dilian is also known as the founder of Circles, a prominent mobile network surveillance company. Dilian is also the founder and CEO of Intellexa.
Cytrox is part of the so-called “Intellexa alliance,” a title that embraces a number of surveillance vendors. The consortium of companies includes Nexa Technologies (formerly Amesys), WiSpear/Passitora Ltd., Cytrox, and Senpai, along with other unnamed entities. They aim to compete with other players in the cyber surveillance market, such as NSO Group and Verint.
Originally based in Cyprus, a recent report shows that Intellexa is now ALSO operating in Greece, which is also listed as the LinkedIn location of its founder, Dilian. Taking a look at the company registry, one will notice that the alliance has a corporate presence not only in Greece (Intelexa SA), but also in Ireland (Intelexa Limited).
The Dun & Bradstreet registration for Intellexa SA and Intellexa Limited lists Sara-Aleksandra Fayssal Hamou (or Sara Hamou) as the principal administrator of both companies. Hamou is said to be Dilian's second wife.
Unfortunately, the relationship between Cytrox and Intellexa, as well as other companies in the “alliance,” remains murky at best. When examining filings with the Israeli business registry, a transfer was observed in 2020 of all shares held by Cytrox Holdings Zrt (Hungary) in Cytrox EMEA Ltd./Balinese Ltd. (Israel) to Aliada Group Inc., an entity registered in the British Virgin Islands (registration no. 1926732).
Prior to this share transfer, Cytrox Holdings Zrt appears to have been the sole shareholder of Cytrox EMEA Ltd./Balinese shares and following this share transfer it appears to remain the sole shareholder of Cytrox Software Ltd./Peterbald. Additionally, a 2017 Intelligence Online article notes that WiSpear Systems “is owned by Aliada Group Inc.”.
Information about Aliada Group Inc. is also relatively scarce. The same 2017 article from Intelligence Online notes that Aliada Group Inc. “is backed by private equity firm Mivtach-Shamir, which invested $3.5 million to acquire a 32% stake in Aliada in December 2016. Mivtach-Shamir is a publicly traded Israeli investment firm founded by Meir Shamir.
When checking the entries for WiSpear/Passitora Ltd. in the Cyprus business register, it is noted that “Mivtah Shamir Technologies (2000) Ltd.” is registered as a director/manager of Passitora Ltd., along with Dilian. An entry was also found in the Israeli business register for a company with the name “Mivtach Shamir Technologies (2000) Ltd.”, which was apparently established in 2000.
Furthermore, a 2020 Haaretz article noted that Avi Rubinstein, a tech entrepreneur, filed a lawsuit against Dilian in the Tel Aviv District Court. According to Haaretz, Aliada Group Inc. is described in the lawsuit as “a group of cyberweapons companies whose products are branded Intellexa.” Two other individuals, Oz Liv, who was also a commander in Israel’s secret military surveillance group called Unit 81, and Meir Shamir, are also named as defendants. According to Haaretz, these two individuals, along with Rubinstein, who filed the lawsuit, and Dilian, are all shareholders in Aliada Group Inc.
Haaretz further notes that Rubinstein accuses Dilian, Liv and Shamir of acting “illegally to reduce [Rubinstein’s] own shares through a pyramid of companies set up abroad. Some of these companies were set up through proxy persons connected to Dilian, including his second wife, Sara Hamou” (as noted above, Sara Hamou’s name appears in corporate registry entries in the Dun & Bradstreet database for Intellexa entities in Ireland and Greece).
The lawsuit also alleged that “this transfer of Aliada’s operations from Israel through chain companies, first to the British Virgin Islands and later to Ireland, violated both Israeli and foreign defense export control laws.”.
Facebook (Meta) warns about Predator spyware and Cytrox!
As a second source of verification comes a report from Meta (formerly Facebook) that clearly states that Cytrox customers include entities in Egypt, Armenia, Greece, Saudi Arabia, Oman, Colombia, Ivory Coast, Vietnam, the Philippines, and Germany, and that abusive targeting was detected originating from Cytrox customers.
Specifically, in a separate investigation conducted by Meta for 7 different malicious software, it reached the same conclusions, confirming the penetration of Cytrox software in Greece and on Greek targets. “The targets of Cytrox and its clients include politicians and journalists around the world,” the Facebook investigation states.
However, Meta’s investigation into Facebook and Instagram accounts revealed a large number of domains that Cytrox used to impersonate legitimate news entities in countries, including Greece, in order to infect citizens with malware. The relevant appendix includes more than 310 fake websites, with 42 set up exclusively for use in Greece. Some of the fake websites are: efsyn.gr, kathimerini, enikos, newsbeast, protothema, tovima, zougla, cnn. You can see all the Greek websites that were targeted [here]
The questions that arise remain unanswered so far.
So, are there any Greek government agencies involved in this specific case? Do law enforcement authorities know all of the above information? Is it possible for third parties to illegally monitor the devices of its citizens without the knowledge of the authorities? Has an investigation and declassification of this information been ordered and have any involved individuals or corporate entities been identified? Were phishing attacks carried out against telecommunications providers with the aim of capturing customer data and using it for unknown reasons?
Will the Greek government and local authorities officially respond to whether private companies illegally used surveillance software on unsuspecting website visitors or do citizens not have the right to know the games that are played against them on a daily basis by strangers? Will they be held accountable?
Many believed that the messages to 13033 regarding our movement during last year's quarantine were a means of "filing" and monitoring us. However, as is now evident from the two major investigations that have been revealed, unknown individuals, unknowingly or under the nose of the Greek state or in possible collusion with corrupt officials, are choosing illegal and dangerous means of monitoring for which the natural perpetrators must be held accountable.
In the meantime, all users should be aware of the situation and be particularly careful when using the internet. A cliché phrase from us, because it is read often, but the security of your personal privacy will never cease to be the main pillar of our website.
Find out how you can protect yourself from the wide range of articles we have uploaded from time to time on ways to protect against malicious software.
With information from: CitizenLab.ca and forbes.com
