Predator Spyware has returned with a new infrastructure after a decline in its activity, which was caused by US sanctions against the Intellexa, according to a report by Recorded Future.
Intellexa, based in Greece, was targeted in March for selling and distributing commercial spyware and surveillance tools. Three other entities were sanctioned for their roles in developing and distributing the Predator spyware.
Read more: Russian hackers use exploits created by NSO Group and Intellexa
The malware, which is primarily used by government agencies, allows operators to infiltrate devices and gain access to sensitive data. They can even activate the 's cameras and microphones without notifying the user.
Intellexa was first mentioned in a Citizen Lab report in 2021, regarding iPhone implant. Last year, the United States added it to an "entity list," restricting its access to American components and technologies.
In July 2024, Cyberscoop reported a significant drop in Intellexa's activity, suggesting that this could be due to either public exposure and sanctions, or the company's ability to evade detection.
See more: EU: Activists call for stricter measures against spyware
A new report from Recorded Future reveals that the creator of the infamous Predator spyware has moved to new infrastructure and upgraded its detection evasion tactics. The tracking tool has been detected in multiple countries, including Angola and the Democratic Republic of Congo (DRC).
The main change is the addition of an additional layer to the multi-layered delivery system. This new layer is designed to anonymize customer activity, making it more difficult to carry out attacks in specific countries.
Predator continues to be used against high-profile individuals, such as politicians, journalists, executives, and activists. It exploits vulnerabilities in browsers and network access , using one-click or zero-click attacks.
Read also: Android spyware Mandrake hides in apps on Google Play
"Although there have been no reported fully remote zero-click attacks, such as those associated with Pegasus, Predator remains an extremely dangerous tool in the hands of those targeting high-profile individuals," Recorded Future reports.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
