The criminal trial in Greece over the use of Predator spyware for illegal surveillance is expected to resume this autumn at the Athens Single-Member Misdemeanor Court. The case had been stalled due to delays in translating essential legal documents into English. At the center of the trial is Intellexa, the spyware firm behind Predator, which, despite growing legal and diplomatic scrutiny, continues to operate internationally.
Greek prosecutors have brought charges against four individuals tied to companies allegedly involved in the wiretapping operation. They face misdemeanor charges related to violations of Greece’s laws protecting the confidentiality of communications. The charges stem from an investigation led by Deputy Prosecutor of the Greek Supreme Court, Achilleas Zisis. The accused include Tal Dilian, a former Israeli intelligence officer and the founder of Intellexa; his wife and company administrator, Sarah Hamu; Felix Bitzios, a businessman and shareholder in Intellexa; and Giannis Lavranos, the owner of Krikel, a Greek technology company. Despite the mounting legal pressure and international sanctions, some of the defendants have reportedly continued their business operations without interruption.
A new report from cybersecurity intelligence firm Recorded Future adds an international dimension to the unfolding legal saga. Its Insikt Group has traced new infrastructure linked to Intellexa in multiple countries, suggesting the company is adapting and expanding even as it comes under increased scrutiny. According to the findings, Intellexa’s Predator spyware remains active across a growing global footprint, with recent discoveries pointing to a previously unknown customer in Mozambique, a connection to a Czech entity, and signs of short-term activity in an Eastern European country, believed to have taken place between August and November last year. That period may have involved testing or development of surveillance tools. Julian-Ferdinand Vögele, a threat researcher at Recorded Future, said Intellexa continues to rely on a broad ecosystem of vendors, affiliates, and shell companies to maintain and obscure its operations.
While Predator activity has declined since the imposition of sanctions and increased media exposure, the firm appears to be actively evolving its tactics to evade detection and disruption.
Among the techniques uncovered are the use of sophisticated fake websites designed to disguise the spyware’s infrastructure. These range from phony 404 error messages and fraudulent login pages to fake “under construction” sites and domains impersonating real-world institutions, including professional conferences. The report concludes that pressure on Intellexa has not diminished its reach but instead has pushed the company to refine its methods and deepen its concealment, raising broader concerns about the resilience of commercial spyware in the face of global regulation.
