Forest Global Training Partners

Cyber Risks · Cisco Talos

Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware

Summary: Cisco Talos traced how Cytrox, a North Macedonia company founded in 2017 that built Android malware, was acquired by WiSpear in 2018 and then folded into the Intellexa Alliance in May 2019 alongside Nexa Technologies and Senpai Technologies, after which its Predator spyware was rebuilt and ready for Android deployment by April 2020. Talos reported that Predator gained reboot survivability on Android by April 2022, that leaked proposals priced the Predator framework at 13.6 million Euros and the Nova data-gathering module at 8 million Euros in 2022, and that the Intellexa Alliance was added to the U.S. Entity List for trafficking in cyber exploits.

What's compelling: Intellexa's contracts put infrastructure and anonymization on the customer and deliver hardware at a terminal or airport under Cost Insurance and Freight terms, which lets the vendor claim it does not know who is targeted or where the systems end up. Talos also found that after its Android exploit chain was patched in November 2021, Intellexa had a new operational chain integrated and shipped to a customer in Sudan by May 2022, so burning a vendor's exploits does not remove the capability.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026