Crofton Black MEMBER_OF Lighthouse Reports
Crofton Black identifies himself as a reporter at Lighthouse Reports.
Explicit Confidence 99% · Crofton Black EP 137 Details
“I’m Crofton Black. I’m a reporter at Lighthouse Reports.”
Episode
05 September 2023 Official episode · Official transcript
mercenary
The episode examines the commercial and mercenary spyware ecosystem around Predator, Cytrox, Intellexa, and Tal Dilian, including its use against journalists and politicians, the Greek spyware scandal, and international sales and export controls.
Topics: Predator mobile spyware capabilities, Commercial and mercenary spyware markets, SS7 exploitation and mobile-carrier signaling, Phishing-based spyware delivery, Safari browser exploitation, One-click and zero-click infection models, Spyware anti-forensics and trace deletion, Spyware infrastructure and domain rotation, iPhone forensic analysis, Surveillance technology export controls, Government oversight and abuse of spyware, Corporate structures in the spyware industry
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Crofton Black MEMBER_OF Lighthouse Reports
Crofton Black identifies himself as a reporter at Lighthouse Reports.
Explicit Confidence 99% · Crofton Black EP 137 Details
“I’m Crofton Black. I’m a reporter at Lighthouse Reports.”
Lighthouse Reports ASSOCIATED_WITH Inside Story
Lighthouse Reports worked with Inside Story in Greece on the investigation.
Explicit Confidence 98% · Crofton Black EP 137 Details
“we at Lighthouse, we wouldn’t have got involved in it without the work that Inside Story in Greece did”
Tal Dilion MEMBER_OF Unit 81
Jack says Tal Dilion served in Unit 81 in the Israeli military.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“Tal went through the Israeli military. Specifically he was in Unit 81”
Circles DEVELOPED_BY Tal Dilion
Jack says Tal left the military and created Circles.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“when he left the military he created a company called Circles”
Circles USES SS7 attacks
Jack believes Circles used SS7 attacks to collect data and intercept communications.
Uncertain Confidence 96% · Jack Rhysider EP 137 Details
“I believe this company that Tal started, Circles, was using SS7 attacks to collect data from targets and intercept messages and phone calls.”
SS7 attacks AFFECTS SS7
Jack describes SS7 attacks as exploiting mobile carriers through SS7.
Explicit Confidence 96% · Jack Rhysider EP 137 Details
“SS7 is a way to exploit mobile carriers into getting info on the users or even taking over their phone number.”
Circles ASSOCIATED_WITH NSO Group
NSO Group purchased Circles from Tal for $140 million.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“NSO Group was like, hey, that’s cool. Can we buy it? Now, NSO Group is someone I’ve covered in detail before. That’s Episode 100, and it’s actually the most-listened to episode of this show. But to quickly recap who they are, NSO Group makes spyware called Pegasus and then sells it to governments around the world who then, well, spy on people. It infects the phone and then gives the government full visibility into it. So, when NSO saw how nifty this Circles company was, they purchased the company from Tal for $140 million.”
Pegasus DEVELOPED_BY NSO Group
Jack says NSO Group makes Pegasus spyware.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“NSO Group makes spyware called Pegasus”
WiSpear DEVELOPED_BY Tal Dilion
Tal and Abraham began a surveillance-tool project that became associated with WiSpear.
Explicit Confidence 88% · Jack Rhysider EP 137 Details
“Together, Tal and Abraham started a new project; a surveillance tool.”
“He had an outfit there called, I think, Wispear.”
WiSpear DEVELOPED_BY Abraham Avni
Jack says Abraham Avni jointly started the surveillance-tool project associated with WiSpear.
Explicit Confidence 85% · Jack Rhysider EP 137 Details
“Together, Tal and Abraham started a new project; a surveillance tool.”
Tal Dilion ASSOCIATED_WITH Cyprus
Tal moved to Cyprus after selling Circles and operated the WiSpear business there.
Explicit Confidence 97% · Jack Rhysider EP 137 Details
“He moved to Cyprus, which is an island nation just off the coast of Israel”
“this business that was being conducted out of Cyprus”
The episode identifies Cytrox as the maker of Predator.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“Cytrox made this phone-hacking software called Predator”
Citizen Lab attributed the analyzed spyware to Predator, and the episode links Predator to Cytrox; the attribution is presented through the investigation's analysis.
Attributed Confidence 99% · Bill Marczak EP 137 Details
“through analysis of the payload as well as analysis of that URL and the website in the URL, we were able to make an attribution back to Predator.”
“this is the Predator spyware made by Cytrox”
Predator DISCOVERED_BY Citizen Lab
Citizen Lab first discovered samples of Predator in late 2021.
Explicit Confidence 99% · Bill Marczak EP 137 Details
“We first discovered samples of Predator back in November, December 2021.”
Citizen Lab describes Predator infections as beginning with a phishing text message.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“First, the victim would receive a phishing text message”
Predator USES one-click infection
The Predator package was advertised as a one-click infection system.
Explicit Confidence 98% · Crofton Black EP 137 Details
“This was a Predator package for ten targets at once. A hundred successful infections, but ten running at the same time. One-click infection.”
Predator USES Safari browser exploit
The episode says the infection website exploits something in the Safari browser to gain a foothold.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“The website exploits something within the Safari browser which then gets a foothold on the phone”
Predator USES anti-forensics
Predator erased traces of the infection process after infecting a phone.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“as soon as it would infect the phone, it would erase the tracks of the whole infection process”
Predator was found on phones belonging to people in Greek civil society, including a journalist and opposition politician.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“At this point, three people from Greece’s civil society were confirmed to have Predator on their phone.”
Predator ASSOCIATED_WITH mercenary spyware
John Scott-Railton classifies Predator as mercenary spyware in his discussion of the category.
Explicit Confidence 98% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”
Citizen Lab ASSOCIATED_WITH Meta
Citizen Lab shared its findings with Meta, which was independently investigating the spyware industry.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“They shared their findings with the security team at Meta, Facebook, who was also investigating”
The episode says Nexa was formerly known as Amesys.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“this other company called Nexa. Nexa was formally known as Amesys.”
Intellexa ASSOCIATED_WITH Cytrox
Intellexa was formed by combining Cytrox with Nexa and other surveillance technology.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“With that technology, he combined the names together, Cytrox and Nexa, to form a new company called Intellexa”
Intellexa ASSOCIATED_WITH Nexa
Intellexa was formed using Nexa technology together with Cytrox and WiSpear technology.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“he combined the names together, Cytrox and Nexa, to form a new company called Intellexa”
Intellexa PART_OF Thalestris
Jack identifies Thalestris as Intellexa's parent company.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“The parent company is called Thalestris”
EYP is identified as Greece's intelligence agency.
Explicit Confidence 99% · Jack Rhysider EP 137 Details
“they landed on this must be the work of EYP, which is Greek’s intelligence agency”
Predator POSSIBLY_SAME_AS Pegasus
The episode compares Predator and Pegasus as similar mercenary-spyware products, but does not assert that they are identical.
Uncertain Confidence 72% · Bill Marczak EP 137 Details
“What is so scary about mercenary spyware like Predator or Pegasus”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:59:49.883086+00:00