Predator

Predator is a highly invasive malware known for its extensive data-stealing and surveillance capabilities. The malicious software, developed by the Intellexa Consortium, a complex international network of decentralized companies, can infect systems through suspicious downloads, emails, or websites and then proceed to steal personal information, disrupt operations, or even hold data hostage for ransom. Cytrox Holdings ZRT initially developed the Predator spyware before production moved to Cytrox AD in North Macedonia. Thalestris Limited, an Ireland-based entity within the Intellexa Consortium, holds distribution rights to the Predator spyware and acts as a financial holding company for the Consortium. Recently, Predator operators have added several layers to enhance their infrastructure, anonymize operations, and evade detection, making it more difficult to identify which countries are using the spyware. In Egypt, recently patched Apple and Chrome zero-days were exploited to infect devices with Predator spyware. Zero-day brokers and commercial spyware vendors can exploit these vulnerabilities to target mobile users and deploy malware like Predator. Baseband exploits are frequently listed in exploit marketplaces with low payouts, indicating their abundance. In early September 2024, researchers from Recorded Future warned that the Predator spyware has resurfaced with fresh infrastructure after a decline caused by US sanctions against the Intellexa Consortium. This resurgence highlights Predator’s ongoing use in countries such as the Democratic Republic of the Congo (DRC) and Angola. While Predator continues to pose significant privacy and security risks, especially to high-profile individuals like politicians and executives, new infrastructure changes make tracking users more difficult. Felix Bitzios, an owner and manager of Intellexa S.A., was involved in supplying Predator to foreign governments.