Predator: Its control center has its roots in Skopje

Predator spyware, which was marketed globally by an Israeli software company and used in Greece and Egypt to spy on journalists, dissidents and others, was developed in North Macedonia – in violation of the Balkan country’s laws. But local efforts to investigate why the software was made in Skopje appear to have stalled. The European Parliament is also investigating the matter.

See also: Predator-YPP: The evidence for the joint surveillance center

Key points

• A series of secret documents from North Macedonia’s intelligence services, obtained by the Athens-based Inside Story and Skopje-based Investigative Reporting Lab (IRL), show that the Predator spyware, at the center of an international scandal, was developed illegally by the company Cytrox in Skopje, North Macedonia – and that North Macedonian government officials knew about it but did nothing to stop it. Cytrox is owned by Intellexa, an Israeli company founded by Tal Dillian. Intellexa is embroiled in an ongoing scandal over the use of the spyware by various governments to target dissidents, journalists and activists. The software has been sold to Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia and Serbia, Citizen Lab has reported.
• The documents show that the government knew as early as 2017 that Cytrox was illegally developing the Predator spyware in the country, with the intention of distributing it elsewhere.
• Documents obtained by Inside Story and IRL reveal the existence of a complex business structure in Skopje, developed by individuals and companies with direct ties to Intellexa. At least five companies with ties to Intellexa were registered in the official business register of North Macedonia between 2017 and 2021. Two of them – Cytrox and CyShark – identified themselves as software developers and traders when they applied for export and production licenses. There was no indication in their public applications that they produced spyware, which would not be permitted under the licenses they applied for and received. However, classified documents obtained by IRL and Inside Story show that the North Macedonian government was informed that Cytrox was planning to create illegal spyware. Experts say the North Macedonian government should have acted to stop production, but did not intervene.
• The documents show that Cytrox and CyShark are part of a group of companies owned by Tal Dilian and his associates. Dilian is a former Israeli security official who founded Intellexa, which is now based in Cyprus. Among the owners of Cytrox is Ivo Malinkowski, a member of a family of well-known North Macedonian winemakers – and arms dealers.
• North Macedonia's interior ministry told lawmakers it was conducting an investigation into the circumstances under which the Predator was created. But there has been no update and little sign of progress.

As the scandal unfolds, Parliament asks questions but receives few answers

On June 19, 2022, a few months after it was revealed that the Predator spyware had infected the mobile phone of Greek journalist Thanasis Koukakis, a group of North Macedonian parliamentarians arrived in Geneva to participate in an intensive training to improve oversight of the country's intelligence services and ensure that these services respect human rights and democratic standards. Hosted by the Geneva Centre for Security Sector Governance, also known as DCAFGeneva Centre for Security Sector Governance, nine members of the North Macedonian Parliament Committee for Oversight of the Work of the National Security Service and the Intelligence Service, along with twelve representatives from other North Macedonian government bodies, attended a training entitled “Extremely Invasive Tools, such as IMSI Catchers, Malware – Their Purpose and Use.”

DCAF’s chief cybersecurity expert, Matej Kovačevski, shared information about various governments and private actors using two dangerously sophisticated spyware programs in his opening email to the training. By then, the public and lawmakers knew that Predator was sold by Intellexa—Dilian’s company—and had been developed by its North Macedonian subsidiary, Cytrox. This was first revealed by the University of Toronto’s interdisciplinary Citizen Lab, which reported in a December 2021 report that Predator, which is sold to hostile governments around the world, had been developed in Skopje. But the report was silent on how this was allowed to happen in North Macedonia, in clear violation of its laws.

The trainer asked the participants what they did to shed light on this disturbing discovery.

“I remember that we all said with pride: ‘Yes, we asked the North Macedonian authorities. They told us that they are already working on the problem. The Interior Ministry staff told us that investigations are underway to determine the circumstances and that the MPs will be informed accordingly once they receive answers,’” former Interior Minister and current MP Pavle Trajanov told IRL journalists in a personal meeting.

The group will meet again five months later, on November 14, 2022, this time in the mountain resort of Mavrovo in North Macedonia. This second training would also be attended by representatives of the North Macedonian Ministry of Interior, the Intelligence Service, the Public Security Bureau and the National Security Service. The guest list included a number of high-level representatives, including Viktor Dimovski, the director of the National Security Service of North Macedonia.

In light of events in neighboring Greece, where it was revealed in 2022 that journalists, ministers and opposition members were being spied on by the Greek government using the legal wiretapping process and the illegal Predator spyware, MEPs would raise new concerns, asking whether the North Macedonian government also had sophisticated spyware.

“The director Viktor Dimovski, after some grumbling, said yes, but claimed that so far they have never used it,” Trajanov told IRL. But the parliamentary group that submitted the questions received few details in response – details they are still seeking.

Recent history shows that it is not particularly surprising that spyware is being deployed in North Macedonia or, more recently, Bulgaria, two countries with weak regulations and even weaker oversight.

See also: Did the Hellenic Police Service monitor Meta's director with Predator Spyware?

A tech-savvy city with a troubled history becomes a hotspot for spyware

In 2015, the then-Macedonian secret police and high-ranking government officials were involved in illegal phone surveillance on a massive scale – more than 20,000 people were monitored between 2008 and 2015, while the government of Nikola Gruevski was in power.

The then director of the Security and Counterintelligence Administration, Saso Mijalkov, is alleged to have illegally intercepted conversations from 5,827 phone numbers, involving more than 20,000 people. The targets included civil society activists, politicians from all parties, journalists, diplomats, and businessmen.

In a similar case, Mijalkov was also investigated in 2016 by the Special Prosecutor's Office of North Macedonia for conducting secret internet surveillance using sophisticated spyware known as Finfisher. Goran Gruevski and Nikola Boskovski, two of Mijalkov's closest confidants among intelligence officers, were indicted for destroying equipment Нов слак Тврдина: Во МВР била уницијена опремера за прислушавење вредна 10 милияние евра | mkd.mk in an attempt to sabotage the prosecutors' investigations.

In October 2017, Gruevski and Boskovski were arrested in Greece, where they had sought political asylum. A court in Thessaloniki ruled that both should be extradited because they did not meet the conditions for political asylum. This decision, however, was overturned by the Supreme Court. Greece’s Supreme Court ruled that because they had been pardoned by the then President of North Macedonia, Gjorge Ivanov, a member of the government that had succeeded Gruevski, they did not need to be extradited. They were awaiting trial on charges of destroying spy equipment in the wiretapping scandal and could face up to 15 years in prison. President Ivanov’s amnesty was widely criticized as a clear attempt to shield a small circle of former ruling party members and their associates from criminal charges. In 2016, Ivanov revoked the pardon after a huge public outcry. But the two men were then granted asylum and live in Greece.

This wiretapping scandal in North Macedonia may have ended the authoritarian regime of the nationalist party led by Nikola Gruevski, but it did not end the connections between the fragile democracy and global spyware dealers. Almost at the same time as the wiretapping scandal was ending, North Macedonia had already become a host country for the development of what would become known as one of the most notorious spyware programs: Predator.

From wine and weapons to the development of spyware

In early 2017, then-26-year-old Macedonian entrepreneur Ivo Malinkovski left his position as head of Chateau Kamnik, his family's wine company, to found and operate several tech startups in Skopje. His job became the development and production of Predator.

In the first months of their existence, on October 6, 2017, two of the companies run by Malinkowski – Cytrox and Cyshark – reportedly requested a license from the North Macedonian Interior Ministry to manufacture, sell, resell and export various software products that could be used to protect personal data – and to extract personal data. This is detailed in classified documents obtained by IRL and Inside Story. The companies would sell this equipment to governments and certified government agencies, such as intelligence agencies, police, border guards and coast guards, the classified documents said. The North Macedonian Interior Ministry stated that it never authorized the production of the spyware. He also stated that he was not aware that this was being produced – but the documents tell a different story: the government had been notified of the plans to produce spyware, which is a violation of North Macedonian law.

Signed by Malinkovski, the application stated that the products the companies seek to create are governed by the law on interception of communications. Consequently, the North Macedonian Interior Ministry should have reviewed their full application, but there is no evidence or documentation to prove that this was done.

The applications submitted on behalf of Cytrox and Cyshark were incomplete. Malinkowski had failed to attach the equipment specifications, which were required by law. The North Macedonian Interior Ministry gave the companies an additional month to submit the required documents. The government unit tasked with reviewing and approving such products is the Counterintelligence Unit of the Ministry of Interior, better known to North Macedonians as the Secret Police.

On November 7, 2017, Malinkowski filed a new document with specifications that were missing from the original application. According to classified documents obtained by the IRL and Inside Story and reviewed by technology at the IRL’s request, the software product in question is what would later become known as Predator, the center of a global scandal. It is a sophisticated weapon that was used to target civil society activists, journalists, and other high-value targets. Some of them, it was later revealed, were in Greece. It was also soon revealed that the smartphone tracking system – the Predator spyware – was being used by authoritarian enemy governments and paramilitary groups around the world, such as the notorious Rapid Support Forces militia in Sudan and the government of Myanmar.

Citizen Lab—a lab at the University of Toronto that focuses on digital espionage—revealed in 2021 that the phones of at least two Egyptian nationals had been hacked with the Predator spyware, developed by a company in North Macedonia called Cytrox. Public records in Skopje show that the CEO is Ivo Malinkowski. Rumors have been circulating that the father, not the son, is actually behind the company, but Ilija Malinkowski denied the allegations in an interview with Balkan InsightWine, Weapons and WhatsApp: A Skopje Spyware Scandal | Balkan Insight.

“Cytrox is allegedly part of Intellexa, the so-called “Star Alliance of spywareThe Lucrative Government Spyware Industry Has a New ‘One-Stop-Shop’ for Hacking Everything | Gizmodo”, which was created to compete with NSO Group and which describes itself as “EU-based and regulated, with six locations and R&D labs across Europe,” the Citizen Lab report states.

However, the software developed in Skopje for Intellexa never received the required license from the Ministry of Interior.

IRL reporters spoke to a Home Office official who had been tasked with handling the request. The first person to respond had declined to make a recommendation. “I wasn’t qualified to understand what the software was, so I passed it on to another officer,” the person said. At least three sources in the counterintelligence unit confirmed to IRL that no one wanted to deal with the request. The Home Office later emailed the IRL that it had not approved the Cytrox and Cyshark requests. The reasons for this reluctance may well have their roots in the hacking scandal that broke in 2015. “The Home Office has not approved such software for the companies in question, nor has it purchased such software,” spokesman Tony Angelovsky said in an email dated December 15, 2022.

See also: Predator inside story: SMS the key to the wiretapping investigation

The connection with North Macedonia

North Macedonia once made global headlines for another Citizens Lab report, which exposed the Gruevski government’s massive wiretapping scandal in 2015. And the tiny Balkan nation found itself in the headlines again on December 16, 2021, when the NGO Citizen Lab in collaboration with Meta published two new reports. This time, the focus was on the Predator software produced by Intellexa’s Cytrox company, which is based in Skopje. On the same day, North Macedonian Prime Minister Zoran Zaev, who was on his way out of office, hosted a party at the luxurious Chateau Kamnik winery. The winery is owned by the Malinkowski family, who have been not only winegrowers but also arms dealers for almost three decades, and recently entered the software business. But while the guests were sipping wine, few knew that the family whose winery hosted the party was at that moment deeply embroiled in one of the world's hottest espionage cases, linked to the use of Predator.

The arms business operates under the name Mikei International, but the Malinkowski family keeps its affairs out of the public eye. There is only one press interview, but no television appearances, no indication of scandal. When Mikei was sanctioned by the US government in 2009 for trading arms with hostile regimes, there was no mention in the media. Unless you are a politician or a journalist, you would not know about their international arms dealing operations. They fly mostly under the public radar. To ordinary North Macedonians, the Malinkowski family is known as the winemakers of Chateau Kamnik, a very popular brand.

The family's arms business and other businesses remained under the public radar until 2017, when Ivo Malinkowski began appearing frequently in the media as a rising star in the global tech world.

“Young and successful, hedonistic, addicted to adrenaline sports and owner of the IT company Cytrox,” is how Ivo Malinkowski is described in the introduction to an interview with local lifestyle magazine Espresso. In several other media interviews in 2018, he is described as the owner of Cytrox, although the actual products and services the company offers are murky. None of this foreshadowed what would soon be nicknamed “the Greek Watergate.” Shortly after the Citizen Lab findings were published, Ivo Malinkowski deleted all of his social media accounts.

According to official documents reviewed by IRL in the North Macedonian state business registry, there is ample evidence of Dilian’s footprint in North Macedonia. Skopje-based Cytrox was founded in March 2017 as a joint-stock company by six foreign businessmen – five from Israel (Dror Harpaz, Sharon Adler, Avraham Rubinstein, Eyal Avraham Oren, Alon Arabov) and one from Hungary (Rotem Farkas). Ivo Malinkowski was listed as their CEO. According to the separate beneficial owner registry, the beneficial owner of Cytrox was Meir Shamir, a former Israeli air force veteran. All have ties to Tal Dilian, according to various public documents found in archives in various countries. Dillian is the head of Intellexa.

The records also show that Dilian expanded his holdings in North Macedonia. Four other companies were registered at the same address in Skopje – each of which had connections to Tal Dilian’s associates: Cyshark, Cygnet, Cintellexa and Cyberlab. All of them were registered between 2017 and 2020. Avraham Rubinstein appears among the beneficial owners of Cytrox and Cyberlab along with Rotem Farkas, while Farkas’ father, Moshe, is a co-owner of Cyshark along with Ivo Malinkowski. All have business connections to Dilian.

“It was basically one company, we all worked in the same offices and we all did the same jobs. Many of the employees had no idea how many companies were registered, we just knew we worked for Intellexa. The salary was better than excellent, so no one cared,” an employee who wished to remain anonymous told IRL.

The former employee, who is also a software engineer, confirmed that what was being produced was the Predator, although they did not know where or how it was being sold. “We also trained the employees in Greece. Everything was controlled from here, because the main product of all Intellexa’s work was in Skopje.”.

The Skopje office was frequently visited by various Israelis, according to sources and data from the border police. The employee could not say exactly who they were, but he knew one person – Sahak Salef. “He was the main person, he was sent here from the beginning by the Israelis to supervise the production work.”.

“We were tasked with finding and hiring, for example, staff in Athens,” the former employee said.

For now, Cytrox's offices in Skopje appear closed, as journalists have noted. Records from the public business registry in North Macedonia show that there have been changes in the ownership structure of Cyshark, one of the companies owned by Moshe Israel Farkas. Now, at least in the papers filed with the business registry, it is owned and managed by Ivo Malinkovski's retired grandmother on his mother's side, Kalia Angelova.

Silence in North Macedonia as scandal takes on European dimensions

Meanwhile, Cytrox has recently been receiving increased attention from the European Parliament. A special committee, PEGA, is currently investigating how Predator was used, after it was discovered that in most European countries, as well as in repressive African regimes, several prominent politicians, journalists and activists were targeted and illegally monitored after their phones were infected with it or other similar software (e.g. NSO's Pegasus).

The Dutch Member of the European Parliament and rapporteur of the PEGA committee, Sophie IN 'T VELD, in a press conferencePress conference by Sophie IN 'T VELD, rapporteur on the PEGA Draft Report | European Parliament presented the findings of the committee's draft report, which was prepared over a period of seven months, and stated that all member states of the European Union have such software, even if they do not admit it.

On page 36, a chapter is dedicated to the software's relations with North Macedonia. The MP wrote to Tal Dilian asking for details:

“Cytrox, under the Intellexa umbrella, started as a start-up in North Macedonia, but according to Forbes, you saved it from bankruptcy with five million dollars. It appears that the corporate structure is quite spread out, with a corporate presence in Hungary, Israel, and a transfer of shares to a corporate entity in the British Virgin Islands. Could you provide us with information about your current and previous role at Cytrox, as well as the relationship between Cytrox and Intellexa? Can Intellexa comment on the reasons for its presence in the British Virgin Islands? Can Intellexa clarify whether Cytrox transferred any of its shares to the British Virgin Islands?” the letter to Dillian, which has not been answered, reads.

According to the Dutch MP, however, the problem was that the software was misused, which poses a huge threat to democracy across the continent.

The North Macedonian Interior Ministry claimed in an email to the IRL that it never authorized the production and sale of this software and that their responsibility ended there. Experts disagree, as does the North Macedonian Parliament committee tasked with monitoring the work of the security services. The North Macedonian government’s Interior Ministry should have filed a lawsuit, the experts said.

Professor and PhD in Security Sciences at the Faculty of Security at the University of St. Kliment Ohridski, Svetlana Nikoloska, said that the institutions of North Macedonia should be very careful about the problem of illegal surveillance of communications. Moreover, for such illegal activities, the Ministry of Interior should automatically act in coordination with the prosecutor, she said. “Such illegal behavior includes various criminal acts that are prosecuted ex officio,” Nikoloska said.

The Interior Ministry had information that the North Macedonian company Cytrox was planning to import and export communications surveillance software. Although the ministry officially claims that it never approved the request to produce this software, it should have done more, said Nikoloska, citing Article 286 of the North Macedonian Criminal Code, which provides for a fine or imprisonment of up to three years for anyone who, with the aim of unauthorized production, puts into circulation, imports, exports or distributes protected integrated circuit topography or software.

“If the software used in Greece to monitor communications has been produced in our country, measures and actions for discovery, clarification and provision of evidence can only be taken at the request of the Greek police. This cooperation takes place at a bilateral level or through INTERPOL, but there should be a specific request and in this case the cybercrime and digital forensics department can work on the case,” he said. So far, however, no coordination effort has been made. Greek judicial sources said they have not contacted North Macedonian authorities in Skopje on the issue of the production of illegal spyware. Asked in Nicosia, Cyprus, where the main export activity of Dilian’s company is coordinated, Cypriot judicial authorities confirmed that they have not been in contact with their North Macedonian counterparts on the issue.

Source: inside story