How is Sudan connected to the Predator scandal that is shaking Greece? An aircraft linked to an Israeli spyware tycoon delivers EU surveillance technology to a notorious Sudanese militia. An investigation resulting from inside story's collaboration with the investigative journalism organization Lighthouse Reports and the Israeli newspaper Haaretz.
On a dusty May morning in Khartoum, a private jet taxied to a stop in the hot sun. Two jeeps with tinted windows were there to greet it – they belonged to one of the most notorious and feared militias in the world, the Rapid Support Forces (RSF).
AOJ71H 18 May 2022 10:26 Khartoum DOF/220518 C750 -LCLK -HSSK
The sleek white Cessna, which had flown in from Cyprus, remained on the ground in the Sudanese capital for just 45 minutes – long enough to draw a chilling line connecting the fierce competition for power in Sudan with a spyware scandal that is shaking Greece.
Details of the Cessna’s arrival, its passengers and its cargo were to remain secret – recorded in an inaccessible location, bypassing normal procedures. The secrecy was a testament to the power of Mohamed Hamdan Dagalo, known as Hemedi, Sudan’s richest man and owner of a private army that inherits the murderous legacy of the Janjaweed, notorious for its crimes against humanity in Sudan’s troubled western region of Darfur.
According to three independent sources, the shipment was high-tech surveillance technology, manufactured in the European Union, with the potential to tip the balance of power in Sudan thanks to its ability to turn smartphones into audiovisual informants against their owners. When news of its arrival reached Hemedi’s opponents, the equipment was deemed so dangerous that an RSF commander, speaking on condition of anonymity, said it was smuggled from Khartoum to the militia’s stronghold in Darfur to prevent it from being seized by the military.
Sudan, Africa’s largest country before civil war and partition, is in a fragile transition following decades of military dictatorship under Omar al-Bashir – now in prison awaiting possible extradition to the International Criminal Court. Waves of popular protests in Khartoum in 2019 led to a political council that shares power uncomfortably with the military. On paper, Hemedi is second in command to Abdel Fattah al-Burhan, the commander-in-chief of Sudan’s armed forces. In reality, the militia leader is trying to gain total control of the country. He controls Sudan’s gold industry, his soldiers fight for pay in foreign conflicts, and he has developed ties to the Russian mercenary group Wagner Group. Hemedi has also met with Israeli intelligence twice since June 2021 – on a private jet used by Mossad and spotted in Khartoum. In the past year alone, RSF fighters have been involved in the enforced disappearance of protesters in Khartoum and indiscriminate shootings of civilians, including children, in Darfur.
The flight from Khartoum opened a rare window into a secret and lucrative operation, linking the bloodstained Sudanese militia to a clique of people wielding power in Greece, a corporate network stretching to Cyprus, the British Virgin Islands and Ireland, and most importantly to a crisis spreading across the EU – the widespread availability of sophisticated software that can track and hack mobile phones worldwide, threatening democratic institutions and human rights defenders.
Lighthouse Reports and its partners, Haaretz in Israel and Inside Story in Greece, are investigating the activities of Intellexa, a spyware company whose operations span Europe and much of the global South. Months of digging into the company’s files and interviews with insiders in multiple countries have uncovered a network of companies linked to Tal Dillian, a former Israeli intelligence agent, who purchased a range of sophisticated surveillance technologies and established a foothold in the EU, via Greece and Cyprus.
The eight-seat Cessna, which plays a key role in Dillian’s business, was revealed by a social media post by an Intellexa engineer—a selfie showing its subject aboard an aircraft with a gray leather and mahogany interior, which left enough digital evidence to isolate and identify the plane. Lighthouse Reports and its partners analyzed and cross-referenced hundreds of flight records, linking the plane to key positions in Intellexa’s business, and combed through dozens of passenger lists, along with corporate records, employment records, and other confidential and open data. The findings definitively link the plane to Dillian, his known associates, and his company employees—including Merom Harpaz, a central figure in his business network.
Through tracking the Cessna's movements in recent months, as it crossed Greece, Cyprus, Israel, the Middle East and Africa, the outline of an international scandal emerges that destabilizes the countries in which it lands, while at the same time funneling some of the world's most dangerous technologies into the hands of some of the most dangerous regimes.
“Equipping the RSF with sophisticated surveillance technology will not only exacerbate the brutal repression and killing of Sudan’s exceptionally brave protesters, but also dash hopes for democracy in the region,” Annette Hoffmann, a senior fellow at the Clingendael Institute, said in the report. “Such advanced spyware in the hands of the RSF would tip the balance of power in favor of a ruthless former militia and ally of Russia, bringing Sudan one step closer to an open confrontation with the country’s armed forces and increasing the risk of civil war.”.
AOJ71H 18 May 2022 15:09 Larnaca DOF/220518 C750 -HSSK -LCLK
Returning from Khartoum that afternoon, the Cessna landed in Larnaca, Cyprus, and pulled up outside the headquarters of a local aviation consultancy, Pegasus Flight Centre. Less than an hour’s drive away, in a posh suburb of Limassol, is a luxurious villa with an enticing kidney-shaped swimming pool, which the millionaire Israeli businessman, Dilian, shares with his wife, Sarah Hamou, a Polish woman who specializes in offshore corporate relocation.
Since leaving the Israeli army’s elite intelligence unit, Unit 81, where he was commander, Dilian has specialized in surveillance tools. Based in Cyprus, he initially founded a pioneering phone-tracking company called Circles, which he sold in 2014. He also went into business with a leader of the Israeli community in Cyprus, Avraham Sahak Avni, co-owner of Pegasus Flight Centre.
For Avni, aviation is part of a diverse portfolio. He describes himself as a “visionary entrepreneur, investor, and philanthropist,” whose interests span a wide range: medical services, robotics, autonomous drones, and intelligence products for law enforcement. Working with Avni’s CIS company, Dillian created a Wi-Fi eavesdropping company called WiSpear and outfitted a van with millions of dollars’ worth of surveillance equipment, which he began exhibiting at industry trade shows in 2017.
Two years later, Dillian and Avni launched a more ambitious plan: an “intelligence alliance,” designed to “fully meet” the needs of government agencies. The press release announced a “one-stop-shop,” a group of companies that could offer device infection and data extraction, Wi-Fi traffic interception, open-source data processing, covert social media activity, and phone geolocation, along with high-powered big data analytics to make sense of it all.
In preparation for this, Dilian had gone on a spending spree. He bought Cytrox, a Hungarian-North Macedonian start-up that developed phone-tracking software called Predator. He brokered a marketing deal with French wiretapping company Nexa and invested in other companies in the cyber-intelligence sector.
By bringing together the capabilities of different specialized industries under one roof, Dillian hoped to compete with the biggest players in the mercenary spyware market—notably the Israeli group NSO Group, now infamous for its Pegasus surveillance software. The new alliance was to be called Intellexa.
Asked to explain the difference between NSO and Intellexa, a senior source in Israel’s offensive spyware industry said: “NSO worked under Israeli law and at times even on behalf of the state of Israel. Ethically, both the company and Israeli policy were questionable, as the sales were made to repressive regimes – but they were regulated. Intellexa on the other hand does not follow Israeli law and sells to similar but worse clients – including those who pose a risk to Israel’s own national interests. A company that does not abide by Israeli law and is not subject to any regulatory authority is de facto a pirate organization.”.
In a harbinger of what was to come, Intellexa’s arrival on the world stage was met with chaos. Dillian apparently intended to base its headquarters in Cyprus, according to an undated name filing in the country’s corporate records system. But before the red tape could be completed, the plan blew up in his face. In August 2019, he gave an on-camera interview to Forbes in which he touted his multimillion-dollar spy van, claiming it could “hack a smartphone and spy on all the messages in it”—even those protected by encrypted apps like WhatsApp and Signal. He sent a few colleagues for a ride outside the van, announcing that “we’re going to track them, we’re going to intercept them, we’re going to infect them.” The video, in which Harpaz is also visible, was not well received by certain sections of the Cypriot establishment, who were concerned that Dilian's operation was competing with the national intelligence service.
Amid allegations of illegal data collection, Dillian’s employees were arrested, offices were raided, and equipment was seized. As warrants were issued for him and Avni, he signaled his intention to move his base of operations elsewhere. “No company can tolerate an unstable business and legal environment that provides no protection from rumors affecting corporate operations,” he said.
Faced with arrest by Cypriot authorities, Dilian was desperate for a new corporate home and had already laid the foundations in 2019 in Greece – just a short plane ride away. As the police investigation into his activities in Cyprus accelerated, Dilian was already reorganizing his business and putting Intellexa to work on behalf of his new hosts. The investigation in Cyprus concluded with the fine being imposed on WiSpear.
AOJ71H 12 April 2022 18:41 Athens DOF/220412 C750 -LCLK -LGAV
The Cessna arrived in Athens the day after the start of a scandal that would destroy Greece’s entire political elite, one of its top businessmen and a handful of other big names. The fuse was Thanasis Koukakis, a veteran business journalist described by his colleagues as “tenacious” who has worked with international media outlets, including the Financial Times.
Koukakis had long suspected that his phone was being monitored, but instead discovered that it was also infected with Intellexa’s Predator software. While spying on a journalist might have caused an outcry elsewhere in the EU, Greece now ranks lower than all European countries in the press freedom rankings published by the international watchdog Reporters Without Borders. Koukakis turned to inside story, a partner in the investigation and one of the few independent investigative groups in Athens. They verified the journalist’s claims, gathered the evidence and broke the story – but it was largely ignored.
The Greek government denied any knowledge of Predator, blaming private actors, while its supporters in the domestic media dismissed Koukakis’ claims of a deeper scandal, saying there was no evidence of other victims. Three days after the Predator revelation, a second investigation emerged, this time by Reporters United – another pillar of Greece’s burgeoning investigative scene. It published documents showing that Koukakis had been monitored by the Greek intelligence service (EYP) for a year before his phone was infected with the spyware.
The government refused to clarify the “national security” concerns that prompted it to wiretap a respected journalist. And the connection to the EYP was all the more troubling, as the conservative government of Kyriakos Mitsotakis had changed the law within days of taking power in 2019 to place the intelligence agency under the direct control and supervision of the prime minister’s office — an office overseen by Mitsotakis’ own nephew, Grigoris Dimitriadis. This is the same Dimitriadis, who senior sources in the Israeli cyber industry said had previously held talks with NSO, the supplier of Pegasus.
Koukakis never believed that he was the only one who had been targeted: "From the beginning I considered it unlikely that such a complex technical surveillance structure as Predator would have been created by the Greek government to monitor just one journalist.".
The suspicion that Predator targeted a single individual became even less convincing in light of a cluster of web domains, attributed to Intellexa’s subsidiary, Cytrox, and uncovered by researchers at Meta and Citizen Lab, both based at the University of Toronto in Canada. This included dozens of domains that mimicked Greek news websites. Lighthouse Reports used a domain information database to record the creation dates of the Greek mimic websites and discovered an ongoing campaign of fake news website registrations, dating back to the summer of 2020. While the domains masqueraded as authoritative news sources, they were actually malicious websites that introduced malware to unsuspecting visitors’ devices. Koukakis’ phone was infected after he clicked on one of these links.
Documents seen by the investigation show that many of these infected domains were registered by a programmer and known associate of Tal Dilian in the Czech Republic. Meanwhile, company records show that, as he moved his office from Cyprus, Dilian had amassed a chaotic mosaic of Intellexa-linked companies spanning multiple other countries.
Dilian built his corporate network through a series of intermediaries – mainly Hamou, a former senior advisor at a firm specializing in offshore trusts, but also Felix Bigziou, a businessman whose work on bad loans at Piraeus Bank was the subject of an investigation by Koukakis in 2019. Three companies with the name Intellexa were registered, in Greece, Ireland and the British Virgin Islands. All three were owned by an Irish holding company, Thalestris. As Inside Story searched company registers in Greece and Cyprus, it found that Thalestris also controlled companies with the names Apollo, Hermes, Mistrona, Dernova, Lorenco and Feroveno – some of which appear to be registered in a dilapidated vacant plot of land in central Limassol. Thalestris, in turn, depended in part on money from another Virgin Islands entity, Chadera Enterprises, which – behind a veil of anonymity – was ultimately controlled by Dillian and two of his associates, leaked documents reveal.
Although the Thalestris holding company retained control of most of these Greek and Cypriot subsidiaries, there were two exceptions, when a piece of the pie was given to key associates of Dilian’s work in Greece, corporate records reveal. Lorenco was sold to Intellexa’s top executive in Greece, Merom Harpaz, while a 35% stake in the Greek company Intellexa went to Dilian’s middleman, Felix Biggio, through another Cyprus-based company, Santinomo.
The complex structure served to obscure the ties between Dilian and Intellexa, covering the group’s accounts with an almost impenetrable smokescreen. But on the ground, some facts remained the same as before. Feroveno, for example, shares the same phone number as Avni’s personal assistant – who corresponded with executives from the Italian Hacking Team about buying hacking software in 2013; who wrote on Dilian’s behalf asking for the Cypriot government’s help in closing a deal with the Netherlands in 2019; and who also acts as the operations manager of the Pegasus Flight Centre, outside which the white Cessna was parked on its return from Sudan.
See also: Predator Greece: What is Felix Bitzios' relationship with Intellexa?
After months of meticulous paperwork, Dillian’s arrival in Greece seemed to be a success. The company’s Greek office near the abandoned airport and former refugee camp in Elliniko grew rapidly and eventually employed a dozen employees. It was also used as a training center and even had a prayer mat area for those from Muslim countries. Flight records show that the Cessna operated regular routes between Athens, Larnaca, and potential customers in the Middle East and elsewhere.
AOJ71H 15 June 2022 8:01 Prague DOF/220615 C750 -LCLK -LKPR
As the white Cessna parked in the Czech capital, it wasn’t alone on the runway. The delegates to ISS World, housed in a grand business hotel east of Prague’s historic center, were flying in for Europe’s leading spy software trade show. Sometimes known as the “spy souk,” it’s a bustling marketplace that attracts police and intelligence agencies from around the world to buy the new tools being shown off by eavesdropping companies. Attendance is strictly limited to government officials and contractors, who chat and exchange ideas over colorful smoothies, elegant glasses of sparkling wine and delicious pastries.
This year’s meeting comes at a time of heightened European concern about the surveillance industry. Last summer, a media consortium had exposed NSO Group’s Pegasus software, showing how it had been used indiscriminately by the company’s clients to hack the phones of human rights activists, politicians and journalists. As a result, the company was sanctioned by the US and is now – along with the industry as a whole – the target of an investigation by the European Parliament. At the opening ceremony in Prague, however, the industry’s black sheep was warmly welcomed as “the very famous NSO Group”.
Behind closed doors, vendors gave government representatives demonstrations of how their products could harvest WhatsApp contact data, gather web browsing logs, and track and hack phones. There were so many eavesdropping devices in the room that the representatives’ phones didn’t work properly. “I only have 2G,” complained one of the trainers, referring to the degradation of cellular signal that often accompanies attempts to grab personal data from a device. Others simply left their phones at home. Slogans throughout the room promised the prevention of “past and future crimes,” a safer world, and the ultimate triumph of truth and justice. Intellexa, one of the event’s sponsors, shared a packed backstage with competitors including Rayzone, Septier, Cleartrail, and NSO.
A leaked business proposal—dated shortly after the Prague report—described the capabilities of Dillian’s new flagship. Predator was expanded and renamed the Nova Remote Intelligence and Analytics Solution. The system included “a fully functional autonomous cyber intelligence platform with social engineering tools.” This is industry jargon for tools that trick people into clicking on malicious links, thinking they came from friends or other trusted sources. It offered “one-click infection via multiple attack vectors,” licensed for 10 targets at once, with “a magazine of 100 successful infections.” The price, including “remote data extraction,” project management, and a 12-month warranty, was $8 million.
Intellexa flew many miles in the air in search of customers. In the months leading up to Prague, the white Cessna took off from Greece and Cyprus to visit Dubai, Abu Dhabi and Riyadh. Confidential documents seen by Lighthouse Reports and its associates show that the company was also pushing hard for deals in Africa and had hired a network of well-known arms dealers to offer its products across the continent. In addition to Sudan, the target clientele included Mozambique, Angola, Kenya and Equatorial Guinea.
Within the EU, governments are supposed to control any sales of surveillance technology to other countries. However, authorities in Greece and Cyprus, when approached for this investigation, refused to reveal whether Intellexa or its affiliated companies had applied or received the necessary legal documents to actually make sales outside the EU.
The most recent set of published accounts for Thalestris, Intellexa’s Irish holding company, shows sales of $35.6 million, more than three-quarters of which were in the Middle East. However, two sources with knowledge of the company’s finances said that over the past three years it has made sales closer to $200 million.
See also: Predator intercepts: Intellexa continues its business undisturbed in Greece
While Intellexa shares were high at the industry event in Prague, its activities in the field were once again destabilizing its host country. Since the revelation of the surveillance of journalist Koukakis in April, the Greek government has repeatedly denied any role or knowledge of the spying operation. But Greece’s small independent media organizations refused to let the story drop, and the government’s denials seemed increasingly tenuous.
AOJ71H 4 August 2022 15:12 Tel Aviv DOF/220804 C750 -LGKR -LLBG
The white Cessna’s arrival in Tel Aviv was not unusual. Along with Athens and Larnaca, Ben Gurion Airport was its most regular stop. But what happened next was highly unusual, as the aircraft remained grounded for 10 weeks. Back in Athens, what was now known as “Greece’s Watergate” was reaching a boiling point.
The attempt to portray Koukakis as an isolated victim collapsed on July 26, when opposition leader and MEP Nikos Androulakis had his phone checked at the European Parliament as part of a security check. It was found that the device had received the same infected message as Koukakis. Three days later, the Greek intelligence service admitted that it had also spied on Androulakis, the leader of the socialist PASOK party, for a period in 2021 – a repeat of the “double” wiretapping that Koukakis suffered.
Meanwhile, Grigoris Dimitriadis, the prime minister's nephew, de facto head of his office and supervisor of the Greek intelligence service, had been identified as the government's link to the spying scandal in early June.
Now, as the Cessna sat on the runway at Ben Gurion, Reporters United presented evidence of his business connections with Felix Biggio, Dillian's protégé and co-owner of Intellexa in Greece.
The “tall one,” as Dimitriadis is referred to in the Greek press, resigned without giving a reason on August 5. The head of the Greek intelligence service, Panagiotis Kontoleon, followed suit. The government denied that Dimitriadis’ departure was related to Intellexa’s activities and stated that Kontoleon resigned due to failures in legitimate surveillance activities.
See also: Wiretapping: Will the prosecution request Predator data from Amazon?
The two resignations came as a shock, after a series of sluggish domestic investigations had sidestepped the key question of who was operating the Predator software in Greece. The Greek Transparency Authority, one of three official investigations, concluded that there was no contract between the state and Intellexa, but it did so without examining Intellexa’s bank accounts. It delayed two months before visiting the company’s offices and did not meet with any of its legal representatives. Similar shortcomings characterized the parliamentary inquiry, led by members of the ruling party, which refused to call key witnesses and in October cleared the prime minister of any knowledge of the espionage case.
The emerging crisis in Greece also diverted the attention of a European parliamentary committee away from the Pegasus scandal, which it had been set up to investigate. In early September, the PEGA committee inquiry held a hearing in Brussels on the events in Greece, where Koukakis gave testimony.
In early November, PEGA members spent four days in Greece and Cyprus seeking evidence of whether European laws had been violated. A senior Greek government official, who asked not to be named, summed up the disdain with which the mission was conducted: “We are pissing on PEGA,” he said.
PEGA rapporteur Sophie in 't Veldt called the Greek government's denials "improbable" and asked why there had been no police investigation into Predator. As it stands, "it's like catching someone with their lips covered in chocolate and crumbs claiming they've never been near the cookie jar." The spyware market, she said, is a threat to democratic institutions in Europe and around the world. "This thing is like gangrene. It will infect one part of the body and then it will spread. You can't contain it.".
With any strategy to contain the scandal now unraveling and with circumstantial evidence overwhelming almost all of the Greek prime minister’s repeated denials, the corrosive effect of powerful spyware technology even in developed democracies is on full display. On November 5, the newspaper Documento published the first 35 names of what it claims is the full list of Predator targets in Greece. Every Sunday, the list is expanded and now includes serving ministers, the inner circle of a powerful shipping and media tycoon, a popular comedian, friends of the prime minister’s wife, senior military officials, and the country’s most respected newspaper publisher. The list goes on.
Read more: insidestory.gr
