Treasury hits Predator spyware makers with more sanctions

It’s another swipe at the Intellexa Consortium, a sprawling network of companies.

The Treasury Department announced sanctions Monday on the Intellexa Consortium, a corporate entity responsible for developing and marketing the notorious Predator spyware.

The sanctions target five individuals and one corporate entity that the U.S. government says were responsible for the spyware’s proliferation.

They are in addition to the sanctions issued in March, when the Treasury Department said Predator has been implicated in the targeting of American government officials, journalists and policy experts. The Biden administration had placed Intellexa on its trade blacklist last summer.

“These sanctions are the next step in our continued effort to deny problematic vendors safe haven across jurisdictions and also demonstrate that there will be accountability measures regardless of corporate structures and shell games that they may be playing,” a senior administration official said during a press briefing Monday. 

The Intellexa Consortium, also sometimes referred to as the Intellexa Alliance, is the network of companies behind the Predator spyware. Its sprawling structure necessitated the additional sanctions, a senior administration official said.

The five people sanctioned Monday were Felix Bitzios, owner of an Intellexa company; Andrea Nicola Constantino Hermes Gambazzi, owner of another consortium company; Merom Harpaz, the top executive of the consortium; Panagiota Karaoli, director of multiple consortium entities; and Artemis Artemiou, general manager of a consortium company.

Aliada Group, a British Virgin Islands-based company and member of the consortium, also was sanctioned. The Treasury Department said the firm enabled tens of millions of dollars worth of transactions involving the network.

There have been signs that the sanctions, as well as exposure of its operations by threat researchers and news outlets, had hindered Intellexa. But there also have been recent signs of Intellexa emerging from a period of relative silence. Furthermore, a recent study found that spyware manufacturers have been able to avoid efforts to constrain them by renaming their companies, starting new ones or moving to different countries.

A senior administration official told reporters Monday that entities like the Intellexa Alliance are “struggling to move their money around” as a result of a series of sanctions against spyware makers. Further measures, such as visa restrictions, also are having an impact, the official said.

“We also have information that commercial spyware executives are concerned about the prospect of visa bans,” the official said. “And we’ve seen publicly available reflections that some cyber technical talent is choosing to avoid getting into the commercial spyware industry to avoid the risk of these accountability measures.”

Treasury’s announcement comes shortly after Apple asked a court to dismiss its lawsuit against spyware industry leader NSO Group, for reasons that include the possibility that court disclosures could jeopardize its efforts to combat spyware, that NSO Group has taken steps to avoid sharing its own information and that the suit’s impact could be diluted as a result of an expanding spyware market with players beyond NSO Group.

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

One House Democrat is pressing Commerce on the government’s spyware use

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems