The U.S. Government announced on March 5 a new set of sanctions on the members of the Intellexa Commercial Spyware Consortium based across Europe. In announcing the new steps, the U.S. State Department framed the U.S. measures as part of a prelude to the Third Summit for Democracy, to be hosted by the Republic of Korea in Seoul on March 18-20. The actions taken by the U.S. Department of Treasury (covered below) were authorized by the Obama-era Executive Order 13694.
The Department of State said:
“The proliferation and misuse of commercial spyware pose growing security risks to the United States. Foreign actors have misused such spyware to enable human rights abuses and to target dissidents globally for repression and reprisal. The United States is today designating two individuals and five entities associated with the Intellexa Consortium for their role in developing, operating, and distributing commercial spyware technology misused to target Americans, including U.S. Government officials, journalists, and policy experts.
Today’s designations aim to discourage the misuse of surveillance tools and reflect U.S. Government efforts to establish clear guardrails for the responsible development and use of these technologies aligned with the protection of human rights and democratic values around the world.”
Treasury Department specifies target entities
The Treasury Department’s Office of Foreign Assets Control (OFAC) has the lead role in managing this set of sanctions. In describing the standard set of controls to be applied, it noted that all property of the designated persons in the United States or in the possession or control of U.S. persons is blocked (frozen) and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also automatically blocked, unless authorized by a general or specific license issued by OFAC, or exempt.
There are also potential penalties for U.S. persons or others transiting the United States that involve any property or interests in property of designated or otherwise blocked persons. Finally, financial institutions and other persons that engage in certain transactions or activities with the sanctioned entities and individuals may themselves suffer an enforcement action.
Intellexa was created in 2019 by former Israeli general Tal Dilian, also involved in earlier spyware production and distribution projects, such as the notorious Pegasus spyware system, making it important for the new company, with a wide range of security-focused clients in both private and public sectors, to operate legally yet in the shadows where possible.
Within Greece the use of the Intellexa Consortium’s Predator spyware has generated sustained controversy in some quarters and the new U.S. sanctions were greeted with approval by opposition politicians who locked onto the American press releases instantaneously as a sign of vindication. Questions remain as to why the known spyware company Intellexa, at that time not yet in the public eye, was allowed to establish itself in Greece and to openly export its software to third countries even as it was exiting fellow EU country Cyprus for still unspecified reasons, recalling that Cyprus itself is still regarded as a location of convenience for “controversial” business and banking activities.
Left-leaning independent media advocates as well as openly pro-opposition journalists have campaigned energetically for several years against the government of Prime Minister Kyriakos Mitsotakis over unsubstantiated allegations that it routinely used the Predator software system to monitor specific opposition leaders, who did in fact discover their phones were infected. Unfortunately for these campaigners, the Greek public paid little attention. Select foreign media outlets however reported steadily on this issue with a sustained anti-government spin.
The sanctioned individuals and entities listed by the Treasury Department follow:
“Tal Jonathan Dilian (Dilian) is the founder of the Intellexa Consortium and is the architect behind its spyware tools. The consortium is a complex international web of decentralized companies controlled either fully or partially by Dilian, including through Sara Aleksandra Fayssal Hamou.
Sara Aleksandra Fayssal Hamou (Hamou), is a corporate off-shoring specialist who has provided managerial services to the Intellexa Consortium, including renting office space in Greece on behalf of Intellexa S.A. Hamou holds a leadership role at Intellexa S.A., Intellexa Limited, and Thalestris Limited.
Intellexa S.A. is a Greece-based software development company within the Intellexa Consortium and has exported its surveillance tools to authoritarian regimes. Intellexa S.A. was added to the Department of Commerce Entity List on July 18, 2023, for trafficking in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.
Intellexa Limited is an Ireland-based company within the Intellexa Consortium and acts as a technology reseller and holds assets on behalf of the consortium. Intellexa Limited was added to the Department of Commerce Entity List on July 18, 2023, for trafficking in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.
Cytrox AD is a North Macedonia-based company within the Intellexa Consortium and acts as a developer of the consortium’s Predator spyware. Cytrox AD was added to the Department of Commerce Entity List on July 18, 2023, for trafficking in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.
Cytrox Holdings Zartkoruen Mukodo Reszvenytarsasag (Cytrox Holdings ZRT) is a Hungary-based entity within the Intellexa Consortium. Cytrox Holdings ZRT previously developed the Predator spyware for the group before production moved to Cytrox AD in North Macedonia. Cytrox Holdings ZRT was added to the Department of Commerce Entity List on July 18, 2023, for trafficking in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.
Thalestris Limited is an Ireland-based entity within the Intellexa Consortium that holds distribution rights to the Predator spyware and acts as a financial holding company for the Consortium.
Dilian, Hamou, Intellexa S.A., Intellexa Limited, Cytrox AD, Cytrox Holdings ZRT, and Thalestris Limited are being designated pursuant to Executive Order (E.O.) 13694, as amended by E.O. 13757, for being responsible for or complicit in, or having engaged in, directly or indirectly, cyber-enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States and that have the purpose or effect of causing a significant misappropriation of funds or economic resources, trade secrets, personal identifiers, or financial information for commercial or competitive advantage or private financial gain.”
