Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Predator ASSOCIATED_WITH mercenary spyware
John Scott-Railton classifies Predator as mercenary spyware in his discussion of the category.
Explicit Confidence 98% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”
Citizen Lab ASSOCIATED_WITH Meta
Citizen Lab shared its findings with Meta, which was independently investigating the spyware industry.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“They shared their findings with the security team at Meta, Facebook, who was also investigating”
Circles ASSOCIATED_WITH NSO Group
NSO Group purchased Circles from Tal for $140 million.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“NSO Group was like, hey, that’s cool. Can we buy it? Now, NSO Group is someone I’ve covered in detail before. That’s Episode 100, and it’s actually the most-listened to episode of this show. But to quickly recap who they are, NSO Group makes spyware called Pegasus and then sells it to governments around the world who then, well, spy on people. It infects the phone and then gives the government full visibility into it. So, when NSO saw how nifty this Circles company was, they purchased the company from Tal for $140 million.”
Tal Dilion ASSOCIATED_WITH Cyprus
Tal moved to Cyprus after selling Circles and operated the WiSpear business there.
Explicit Confidence 97% · Jack Rhysider EP 137 Details
“He moved to Cyprus, which is an island nation just off the coast of Israel”
“this business that was being conducted out of Cyprus”
Citizen Lab attributed the analyzed spyware to Predator, and the episode links Predator to Cytrox; the attribution is presented through the investigation's analysis.
Attributed Confidence 99% · Bill Marczak EP 137 Details
“through analysis of the payload as well as analysis of that URL and the website in the URL, we were able to make an attribution back to Predator.”
“this is the Predator spyware made by Cytrox”
The episode identifies Cytrox as the maker of Predator.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“Cytrox made this phone-hacking software called Predator”
Circles DEVELOPED_BY Tal Dilion
Jack says Tal left the military and created Circles.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“when he left the military he created a company called Circles”
WiSpear DEVELOPED_BY Tal Dilion
Tal and Abraham began a surveillance-tool project that became associated with WiSpear.
Explicit Confidence 88% · Jack Rhysider EP 137 Details
“Together, Tal and Abraham started a new project; a surveillance tool.”
“He had an outfit there called, I think, Wispear.”
Pegasus DEVELOPED_BY NSO Group
Jack says NSO Group makes Pegasus spyware.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“NSO Group makes spyware called Pegasus”
WiSpear DEVELOPED_BY Abraham Avni
Jack says Abraham Avni jointly started the surveillance-tool project associated with WiSpear.
Explicit Confidence 85% · Jack Rhysider EP 137 Details
“Together, Tal and Abraham started a new project; a surveillance tool.”
Predator DISCOVERED_BY Citizen Lab
Citizen Lab first discovered samples of Predator in late 2021.
Explicit Confidence 99% · Bill Marczak EP 137 Details
“We first discovered samples of Predator back in November, December 2021.”
Crofton Black MEMBER_OF Lighthouse Reports
Crofton Black identifies himself as a reporter at Lighthouse Reports.
Explicit Confidence 99% · Crofton Black EP 137 Details
“I’m Crofton Black. I’m a reporter at Lighthouse Reports.”
Tal Dilion MEMBER_OF Unit 81
Jack says Tal Dilion served in Unit 81 in the Israeli military.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“Tal went through the Israeli military. Specifically he was in Unit 81”
Intellexa PART_OF Thalestris
Jack identifies Thalestris as Intellexa's parent company.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“The parent company is called Thalestris”
Predator POSSIBLY_SAME_AS Pegasus
The episode compares Predator and Pegasus as similar mercenary-spyware products, but does not assert that they are identical.
Uncertain Confidence 72% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”
The episode says Nexa was formerly known as Amesys.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“this other company called Nexa. Nexa was formally known as Amesys.”
Predator was found on phones belonging to people in Greek civil society, including a journalist and opposition politician.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“At this point, three people from Greece’s civil society were confirmed to have Predator on their phone.”
Circles USES SS7 attacks
Jack believes Circles used SS7 attacks to collect data and intercept communications.
Uncertain Confidence 96% · Jack Rhysider EP 137 Details
“I believe this company that Tal started, Circles, was using SS7 attacks to collect data from targets and intercept messages and phone calls.”
Predator USES one-click infection
The Predator package was advertised as a one-click infection system.
Explicit Confidence 98% · Crofton Black EP 137 Details
“This was a Predator package for ten targets at once. A hundred successful infections, but ten running at the same time. One-click infection.”
Citizen Lab describes Predator infections as beginning with a phishing text message.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“First, the victim would receive a phishing text message”
Predator USES Safari browser exploit
The episode says the infection website exploits something in the Safari browser to gain a foothold.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“The website exploits something within the Safari browser which then gets a foothold on the phone”
Predator USES anti-forensics
Predator erased traces of the infection process after infecting a phone.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“as soon as it would infect the phone, it would erase the tracks of the whole infection process”
Punjab family-impersonation scam ASSOCIATED_WITH Pakistan
The episode presents a possible Pakistan connection: Tarun received scam calls from a Pakistan number, but this does not establish that all of the scammers are located in Pakistan.
Uncertain Confidence 78% · Tarun EP 138 Details
“I got two calls from a number in Pakistan. It had the area code of +92”
Punjab family-impersonation scam INVOLVES social engineering
The scam is presented as social engineering in which callers manipulate relatives into sending money.
Explicit Confidence 99% · Jack Rhysider EP 138 Details
“The idea here is simple; the scammer will pose as someone you know and ask you for money.”
Punjab family-impersonation scam INVOLVES Pretexting
The callers use fabricated emergencies, arrests, criminal charges, and legal problems as pretexts for requesting money.
Derived Confidence 96% · Cousin EP 138 Details
“I’m calling you because I’m in trouble and I need your help.”