Virtual Event Now Live: Zero Trust Strategies Summit! - Login for Access
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Nation-State

Predator Spyware Resurfaces With Fresh Infrastructure

Recorded Future observes renewed Predator spyware activity on fresh infrastructure after a drop caused by US sanctions.

The Predator spyware has resurfaced with fresh infrastructure after a drop in activity caused by US sanctions against Intellexa Consortium, Recorded Future reports.

Intellexa, based in Greece, was sanctioned in March for selling and distributing commercial spyware and surveillance tools. Three other entities were sanctioned for their roles in the development and distribution of the Predator spyware.

The malware, primarily used by government actors, allows operators to infiltrate devices and access or exfiltrate sensitive data, and even to activate the infected device’s cameras and microphones, without the user’s knowledge.

Intellexa was first mentioned in a 2021 Citizen Lab report on Cytrox’s Predator iPhone implant and the US added it to an ‘entity list’ last year, limiting its access to American-made components and technologies.

In July 2024, Cyberscoop reported a significant decline in Intellexa’s activity, noting that it could have been either caused by public exposure and imposed sanctions or the result of the company managing to avoid detection.

Recorded Future’s new report shows that the creator of the infamous Predator spyware has shifted to new infrastructure and has updated detection evasion. Its surveillance tool has been seen in multiple countries, including Angola and the Democratic Republic of the Congo (DRC).

The main change observed is the inclusion of an additional tier in the multi-tiered delivery system, designed to anonymize customer operations and make it more difficult to attribute attacks to a specific country.

Predator continues to be used against high-profile individuals, including politicians, journalists, executives, and activists, employing one-click or zero-click exploits targeting browser vulnerabilities and network access for infection.

Advertisement. Scroll to continue reading.

“Even though there are no reports of fully remote zero-click attacks, like those associated with Pegasus, Predator remains a dangerous tool in the hands of those targeting high-profile individuals,” Recorded Future says.

Related: Google Catches Russian APT Reusing Exploits From Spyware Merchants NSO Group, Intellexa

Related: Information of Hundreds of European Politicians Found on Dark Web

Related: Spain Needs More Transparency Over Pegasus: EU Lawmakers

Related: In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Former Darktrace CEO Poppy Gustafsson has joined the UK government as Minister for Investment.

Nupur Goyal has joined cloud identity security and management solutions provider Saviynt as VP of Product Marketing.

Threat intelligence firm Intel 471 has appointed Mark Huebeler as its COO and CFO.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.