Difference between revisions of "Cytrox"
(Expand surveillance research with sourced history, people and financial tables; preserve existing coverage) |
(Add infobox logo (Cytrox logo.png)) |
||
| Line 1: | Line 1: | ||
{{short description|'''Spyware developer within the Intellexa consortium'''}} | {{short description|'''Spyware developer within the Intellexa consortium'''}} | ||
{{Infobox organization | {{Infobox organization | ||
| + | | logo = Cytrox logo.png | ||
| name = [[Cytrox]] | | name = [[Cytrox]] | ||
| type = Commercial spyware developer; multiple legal entities | | type = Commercial spyware developer; multiple legal entities | ||
Latest revision as of 15:37, 10 November 2026
Spyware developer within the Intellexa consortium
| Cytrox
| |
|---|---|
| Logo | 
|
| Type | Commercial spyware developer; multiple legal entities |
| Founded | 2017 [1] |
| Headquarters | North Macedonia; associated entities in Hungary and Israel [1] |
| Area served | Government customers internationally |
| Services | Predator spyware [1] |
| Key people | Ivo Malinkovski (chief executive identified by Citizen Lab in 2021); Tal Dilian (linked acquirer through WiSpear) [1] |
| Remarks | Part of the Intellexa consortium; Cytrox AD and Cytrox Holdings ZRT designated by the US Department of the Treasury on 5 March 2024 [2] |
Cytrox is a developer of Predator spyware associated with the Intellexa consortium. Citizen Lab reported that it began as a North Macedonian start-up in 2017 and had linked corporate entities in Israel and Hungary. The group includes distinct companies, including Cytrox AD in North Macedonia and Cytrox Holdings ZRT in Hungary.[1][2]
Corporate history and Israeli connections
Citizen Lab's December 2021 investigation found that Cytrox EMEA Ltd. and Cytrox Software Ltd. had been incorporated in Israel in 2017 and renamed Balinese Ltd. and Peterbald Ltd. respectively in 2019. It reported that WiSpear, associated with former Israeli Unit 81 commander Tal Dilian, acquired Cytrox in 2018. Citizen Lab described the precise relationships within the wider Intellexa alliance as incompletely resolved by the registry records it examined.[1]
Cytrox originated in North Macedonia; its later Israeli corporate and ownership connections are distinct from its place of origin. Unit 81 and Unit 8200 are separate units; Dilian's service in the former does not establish service in the latter.[1]
| Person or entity | Role or jurisdiction | Date and qualification |
|---|---|---|
| Ivo Malinkovski | Chief executive identified by Citizen Lab | 2021; a historical identification, not confirmation of the present officeholder [1] |
| Tal Dilian; WiSpear | Reported acquirer | Acquisition reported as occurring in 2018 [1] |
| Cytrox AD | North Macedonia | Treasury described it as developer of Predator in March 2024 [2] |
| Cytrox Holdings ZRT | Hungary | Treasury described earlier Predator development before production moved to North Macedonia [2] |
Predator and forensic findings
In December 2021 Citizen Lab reported that Egyptian opposition politician Ayman Nour and an anonymous exiled Egyptian journalist had been hacked with Predator in June 2021. It recovered and analysed a loader and described single-click links delivered through WhatsApp, affecting the then-current iOS 14.6. Nour's phone was also infected with NSO Group's Pegasus by a different government client, illustrating that more than one operator could target the same device.[1]
The researchers' network scans identified likely Predator customers in several countries, but this inference was separate from forensic confirmation of the two examined phones. The report did not establish that every server or jurisdiction identified represented a successfully infected victim.[1]
US designations
The US Department of the Treasury designated Cytrox AD and Cytrox Holdings ZRT on 5 March 2024 alongside Tal Dilian, Sara Hamou and other Intellexa entities. The notice also records that the two Cytrox entities had been added to the US Department of Commerce Entity List on 18 July 2023. Treasury attributed the sanctions to development, operation and distribution of spyware used to target Americans; these are administrative designations, not criminal convictions.[2]
Meta platform investigation
In December 2021 Meta said that it had removed about 300 Facebook and Instagram accounts linked to Cytrox. It reported domains imitating news organisations and URL-shortening services, and technical checks that limited infection to selected IP addresses and device types. The report attributed the activity to Cytrox and its customers and identified politicians and journalists among the targets.[3]
See also
Notes
- ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 Citizen Lab, Pegasus vs. Predator: Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware, Citizen Lab, 16 December 2021, key findings and sections 1.1–1.2, 2 and 4, accessed 8 November 2026.
- ↑ 2.0 2.1 2.2 2.3 2.4 US Department of the Treasury, Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium, US Department of the Treasury, 5 March 2024, “Key Enablers” and “Sanctions Implications”, accessed 8 November 2026.
- ↑ Mike Dvilyanski, David Agranovich and Nathaniel Gleicher, Threat Report on the Surveillance-for-Hire Industry, Meta, 16 December 2021, p. 10, accessed 8 November 2026.