Since 2020 in #Greece, the national intelligence agency #EYP has been implicated in using Israeli-made " #Cytrox #Predator " #spyware to target journalists, opposition and activists (having full access to its WhatsApp etc). This scandal led to significant resignations:
* Panagiotis Kontoleon, the head of Greek agency EYP, stepped down in August 2022.
* G. Voulgarakis, a senior aide to Prime Minister Kyriakos Mitsotakis, also resigned.
more in english: https://www.dnews.gr/eidhseis/news-in-english/522954/predator-spyware-intellexa-and-the-greek-surveillance-scandal-head-back-to-courtabout
The trial over the illegal use of Predator spyware in Greece, one of the country’s most significant surveillance scandals in recent history, is set to resume on April 23 at the Athens Single-Member Misdemeanor Court.
Would-be president pwned by President: #AhmedTantawy had phone hacked; #CitizenLab says Egyptian govt did it.
Fingered: @VodafoneEgypt, @Sandvine and #Cytrox itself. In today’s #SBBlogwatch, we rethink seeing pyramids. At @TechstrongGroup’s @SecurityBlvd: https://securityboulevard.com/2023/09/ios-zero-cytrox-predator-richixbw/?utm_source=richisoc&utm_medium=social&utm_content=richisoc&utm_campaign=richisoc
#Cybersecurity #Egypt #Spyware #Predator #Cytrox: "- Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox’s Predator spyware via links sent on SMS and WhatsApp. The targeting took place after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections.
- In August and September 2023, Eltantawy’s Vodafone Egypt mobile connection was persistently selected for targeting via network injection; when Eltantawy visited certain websites not using HTTPS, a device installed at the border of Vodafone Egypt’s network automatically redirected him to a malicious website to infect his phone with Cytrox’s Predator spyware.
- During our investigation, we worked with Google’s Threat Analysis Group (TAG) to obtain an iPhone zero-day exploit chain (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993) designed to install Predator on iOS versions through 16.6.1. We also obtained the first stage of the spyware, which has notable similarities to a sample of Cytrox’s Predator spyware we obtained in 2021. We attribute the spyware to Cytrox’s Predator spyware with high confidence.
- Given that Egypt is a known customer of Cytrox’s Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the network injection attack to the Egyptian government with high confidence.
- Eltantawy’s phone was additionally infected with Cytrox’s Predator spyware two years prior, in November 2021, via a text message containing a link to a Predator website."
Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox's Predator spyware via links sent on SMS and WhatsApp after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections. As Egypt is a known customer of Cytrox's Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the attack to the Egyptian government with high confidence.
While the US has blacklisted #Intellexa and #Cytrox entities in Greece, Ireland, Hungary and North-Macedonia as risk to national security, Europe is still a comfy home to these vendors of mercenary #spyware. Will @EU_Commission finally take action? My questions 👇 https://t.co/rQ23NXtTZR
🐦🔗: https://n.respublicae.eu/SophieintVeld/status/1682358169538904064
“While the US has blacklisted #Intellexa and #Cytrox entities in Greece, Ireland, Hungary and North-Macedonia as risk to national security, Europe is still a comfy home to these vendors of mercenary #spyware. Will @EU_Commission finally take action? My questions 👇”
The U.S. government added surveillance technology vendors Cytrox and Intellexa to an economic blocklist for trafficking in cyber exploits. The Commerce Department’s Bureau of Industry and Security (BIS) added surveillance technology vendors Intellexa and Cytrox to the Entity List for trafficking in cyber exploits used to gain access to information systems. The Entity List maintained […]
The Threat Codex
Pavel 🇪🇺
Matt Willemsen
ITSEC News
Richi Jennings
Miguel Afonso Caetano
Benjamin Carr, Ph.D. 👨🏻💻🧬
Sophie in 't Veld
securityaffairs