With his name linked to scandals in Cyprus and Greece, the former Israeli is one of the most controversial people in Europe today. An OSINT investigation by Solomon reveals how a months-long campaign attempted to manipulate the positive narrative around Tal Dilian’s person and business activities.
See also: Predator: Its control center has its roots in Skopje
«From creating equal opportunities for disadvantaged youth to providing innovative solutions in the information sector, Tal Dillian's quest for a new challenge never».
This is how Tal Dilian, the former commander of the elite cybersecurity division of Israel's military intelligence service Unit 81 and current businessman, introduces himself, through his official website . With a cursory search for his name on the Internet, the website taldilian.com is at the top of the results returned by the search engine.
However, in recent years the name of the Israeli businessman has found itself in the public eye in less flattering ways.
Connected with surveillance scandals in Cyprus and Greece, Tal Dillian is one of the most controversial people in Europe today: his name is mentioned dozens of times in a report by the PEGA Committee of the European Parliament on the use of spyware software in Europe.
Leveraging OSINT tools (Open-Source Intelligence), Solomon reveals how the mastermind behind the malicious software Predator, and the legitimate representative of the Intellexa group of companies that markets it, attempted to reshape his image on the internet, mechanically manipulating search engine results (such as Google) in order to bury negative references and strengthen the positive narrative around his name and activity.
Within the framework of a multi‑year electronic campaign, it appears that hundreds of automated links have been utilized, which were published at different addresses hosted on at least 18 platforms.
Solomon's research and analysis of the data surrounding the campaign in question, and the efforts of the "Israeli cyber czar", as he was recently characterized by Intelligence online, to manipulate content concerning him, showed the following:
- Hundreds of articles that were generated automatically refer to specific websites, which present Tal Dilian as a business mind and paint a positive profile of Intellexa.
- Search engines, noticing that many articles refer to those websites (and considering them for’ this reason «reliable»), they «raise» higher in the preferences.
- This results in, when a user on the internet searches for keywords such as “Tal Dilian” and “Intellexa”, the first results that appear are those promoted by the campaign.
- At the same time, however, the campaign also serves a possibly more critical purpose: “pushes”» down in the results list the articles that concern the same keywords but contain incriminating elements or generate negative publicity.
A website that raises questions
But let's start from the beginning.
While browsing the internet, we came across a website that initially piqued our interest.
Its address: taldilianintellexajbkx529.weebly.com. The title of the website: Tal Dilian Intellexa best blog 1073.
The question naturally arises: Who uses the term best blog or a number like 1073 in the title of a blog?
The blog in question has been created on weebly.com, a platform that is recommended as "the easiest way" to - for free - "create a website, a blog, or an online store."
Browsing the website, we soon discovered that the content of the texts that have been posted there, as well as the title, appear to have not been written by a human hand. But automated.
A simple search for similar websites that bear the name Tal Dylan and are also hosted on weebly.com yields dozens of corresponding results.
Observing the results, we see that all the websites share the same characteristics: similar titles and URLs, and common word-for-word texts that appear to have been generated mechanically.
This is an indication that it is probably not a series of coincidences, but a campaign. But why would a campaign of this kind be limited to one platform?
So, we started looking for addresses with related titles or content on other platforms.
At least 463 links on 18 platforms
We identified at least 463 links. In addition to weebly.com, these links are hosted on at least 17 similar platforms, where one can also easily publish free content.
The titles of the websites we identified on the other platforms also follow the same pattern: at the beginning the words “Tal Dilian” and “Intellexa”, then a phrase such as “nice” or “excellent blog”, and then a number follows.
And the addresses follow the following patterns:
- taldilian[random alphanumeric string].[platform]
- taldilianintellexa[random alphanumeric string].[platform]
- intellexa[random alphanumeric string].[platform]
Some illustrative examples are shown in the table below.
The random strings of letters and numbers in blog titles and at the beginning of each address (subdomain), as well as the content of the texts that repeats verbatim, indicate that the websites have been created automatically, and therefore constitute part of a campaign.
In the field of technology and SEO (Search Engine Optimization), that is, the techniques with which an address can be found higher in search engines, such campaigns are known as “Black Hat SEO campaigns” (corresponding to Black Hat Hacking).
They concern methods for creating «non-organic» content (that is not produced by humans), through automated publications, which aim to prioritize specific results in the search engines we use.
See also: Predator-YPP: The evidence for the joint surveillance center
At least 7 months the duration of the campaign
In order to find the period during which the campaign ran, we selected a list of blogs. Using a small code program (script), we gathered into a list the dates of the articles (posts) that were published on them as part of the campaign.
[The full list can be found here.]
From this list, the first article appears to have been published on November 16, 2021. The last on June 12, 2022.
This means that, although there are likely other websites hosted on more platforms, safely conclude that the campaign lasted for at least seven months.
During that period, the surveillance scandal in Cyprus had already been uncovered, which Tal Dilian had made the basis of his business activity since 2013.
As the inside story writes, overestimating "the ability of the Cypriot staff to withstand the pressure of a major news story," in 2019 Dilian demonstrated in a Forbes video the capabilities of the famous black van, which - as he claimed - could "hack" any mobile phone within its range.
After the uproar, Dillian’s company in Cyprus was found guilty of 42 charges and fined. Dillian moved his operations to Greece, from where the Predator spyware is now exported , including to countries with authoritarian regimes . By the end of the campaign, the early stages of the wiretapping scandal had also emerged in Greece, while the Predator infection of the mobile phone of journalist Thanasis Koukakis — the first victim of many to follow — had also been revealed .
What the campaign targeted
A campaign of this kind aims to manipulate the results returned by search engines, raising positive references in the results and «burying», ’by extension, keeping unwanted content low.
Specifically, Black Hat SEO campaigns share the common characteristic of repeating keywords (keywords) and backlinks (backlinks), which lead to the websites they want to promote.
So, since we knew – as we saw above – the keywords (Tal Dilian, Intellexa) that appear in the titles and URLs, we just needed to find which links the campaign promotes.
With the help of a script, we visited every website we had at our disposal, extracting the links it contained. As we expected, the links are repeated — so we recorded exactly how many times each link.
The entire list can be found here.
We found that the two main links that appear most frequently refer to Tal Dilian's website (at least 172 times) and Intellexa's (at least 149 times).
What follows are basically articles praising the work of Dilian and Intellexa. One such article is from the Cypriot newspaper Phileleftheros, which reports that "Tal Dilian has broken his silence on the spy van", presenting his relevant announcement in its entirety.
Among the above links, particular interest is shown that, apart from Tal Dillian, some links refer to the Nigerian pastor Chris Oyakhilome — he is a controversial figure, as in 2019 he was accused of financial fraud. Other links refer to Bimbo Success, a popular Nigerian actress on social media.
At this point, we may not be able to know exactly who ran the campaign. However, we understand that whoever ran it has also run other campaigns, besides Tal Dillian's, for clients who also wish to manipulate their image on the internet.
See also: Did the Hellenic Police spy on Meta's director with Predator Spyware?
Dillian's website
To understand how the campaign worked, we must follow the chronological sequence of the various stages that follow the creation of Tal Dillian's personal website.
The address taldillian.com was purchased on August 25, 2021, two and a half months before the start of the campaign.
The period immediately thereafter, positive articles about the name and its business activity appear in online newspapers and magazines.
Considering the dates of the articles' original publication and their posting on Tal Dillian's website, we observe that they are republished from the same day up to a maximum of six days later. The articles republished on the website are the same articles that the campaign is trying to promote.
Also, overall, and with only one exception, the articles appear to have been published 1-2 months before the campaign started. With the start of which, both these and Tal Dillian's website are widely disseminated and prioritized for search engines, through multiple references to them.
Before publication, Solomon asked Tal Dillian questions about the campaign. We also asked for a comment on the criticism he and Intellexa have received for their alleged involvement in the wiretapping scandal, which the international press has dubbed the "Greek Watergate."
Even up to the moment this research is published, we have not received a response.
Source: Solomon
