The episode identifies Cytrox as the maker of Predator.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“Cytrox made this phone-hacking software called Predator”
Malware
malware:predator
Also: Predator spyware, Predatory spyware
Phone spyware capable of exfiltrating files, capturing passwords, activating the microphone and camera, reading messages, and reporting location.
Phone spyware capable of exfiltrating files, capturing passwords, activating the microphone and camera, reading messages, and reporting location.
“Analysis of this application quite clearly established that it was spyware.”
“It had the capability to, for instance, exfiltrate files from the phone, take passwords, turn on the microphone”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DEVELOPED_BY | Cytrox | Explicit | 137 |
| outgoing | ATTRIBUTED_TO | Cytrox | Attributed | 137 |
| outgoing | DISCOVERED_BY | Citizen Lab | Explicit | 137 |
| outgoing | USES | phishing | Explicit | 137 |
| outgoing | USES | one-click infection | Explicit | 137 |
| outgoing | USES | Safari browser exploit | Explicit | 137 |
| outgoing | USES | anti-forensics | Explicit | 137 |
| outgoing | TARGETS | Greece | Explicit | 137 |
| outgoing | ASSOCIATED_WITH | mercenary spyware | Explicit | 137 |
| outgoing | POSSIBLY_SAME_AS | Pegasus | Uncertain | 137 |
The episode identifies Cytrox as the maker of Predator.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“Cytrox made this phone-hacking software called Predator”
Citizen Lab attributed the analyzed spyware to Predator, and the episode links Predator to Cytrox; the attribution is presented through the investigation's analysis.
Attributed Confidence 99% · Bill Marczak EP 137 Details
“through analysis of the payload as well as analysis of that URL and the website in the URL, we were able to make an attribution back to Predator.”
“this is the Predator spyware made by Cytrox”
Predator DISCOVERED_BY Citizen Lab
Citizen Lab first discovered samples of Predator in late 2021.
Explicit Confidence 99% · Bill Marczak EP 137 Details
“We first discovered samples of Predator back in November, December 2021.”
Citizen Lab describes Predator infections as beginning with a phishing text message.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“First, the victim would receive a phishing text message”
Predator USES one-click infection
The Predator package was advertised as a one-click infection system.
Explicit Confidence 98% · Crofton Black EP 137 Details
“This was a Predator package for ten targets at once. A hundred successful infections, but ten running at the same time. One-click infection.”
Predator USES Safari browser exploit
The episode says the infection website exploits something in the Safari browser to gain a foothold.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“The website exploits something within the Safari browser which then gets a foothold on the phone”
Predator USES anti-forensics
Predator erased traces of the infection process after infecting a phone.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“as soon as it would infect the phone, it would erase the tracks of the whole infection process”
Predator was found on phones belonging to people in Greek civil society, including a journalist and opposition politician.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“At this point, three people from Greece’s civil society were confirmed to have Predator on their phone.”
Predator ASSOCIATED_WITH mercenary spyware
John Scott-Railton classifies Predator as mercenary spyware in his discussion of the category.
Explicit Confidence 98% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”
Predator POSSIBLY_SAME_AS Pegasus
The episode compares Predator and Pegasus as similar mercenary-spyware products, but does not assert that they are identical.
Uncertain Confidence 72% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”