For over three decades, a range of digital tools with mythical, evocative names have been deployed in silence across the globe, quietly infiltrating devices and accessing sensitive information. These tools—spyware—function as powerful instruments for unauthorized surveillance, often designed to extract personal and confidential data from internet-enabled devices. Despite efforts to regulate the industry, the global spyware market continues to flourish, driven by the demands of government clients who prioritize surveillance capacities over human rights considerations. The impact of this technology is far-reaching, with profound implications for national security, civil liberties, and the integrity of global diplomatic relationships.

This article explores the complex ecosystem that sustains the spyware market, addressing its far-reaching consequences for both state actors and private individuals. It examines the balance—or lack thereof—between the claimed legitimate uses of spyware by law enforcement and intelligence agencies and the frequent abuses of these technologies that infringe upon human rights. As states increasingly rely on spyware to monitor, control, and, at times, eliminate dissidents, journalists, and political opponents, there remains little transparency or accountability in how these tools are employed.

The Global Spyware Market: A Growing Threat

At present, 195 countries exist globally, and, disturbingly, at least eighty of these nations have procured spyware from commercial vendors. Among them, the NSO Group—famous for its Pegasus software—has dominated sales, with fourteen of the twenty-seven European Union (EU) countries purchasing its products. This paints a troubling picture of global reliance on spyware. Despite various regulatory efforts aimed at curbing its proliferation, the market continues to expand. This expansion is not limited to just software sales; instead, it encompasses a web of interlinked vendors, suppliers, and investors that fuel the growth of the spyware industry.

Spyware vendors are responsible for 50% of all zero-day exploits detected in 2023. Zero-day vulnerabilities are critical software flaws that are unknown to the vendor and hence can be exploited without any patches or fixes. This trend reveals a new level of sophistication in the spyware landscape, as attackers increasingly focus on mobile and browser software. The challenge to regulate these technologies is compounded by their dual-use nature—technologies that can be used for both civilian and defense purposes, blurring the line between legitimate law enforcement applications and nefarious state surveillance.

While the exact size of the spyware market remains elusive, one vendor alone sought a $2 billion valuation in an initial public offering. This speaks to the staggering commercial value attached to the industry, despite its opaque nature and the ethical concerns surrounding it.

Legitimate Use or Tool for Oppression?

Proponents of spyware often argue that it serves as a vital tool for law enforcement and intelligence operations. However, its capacity for abuse is undeniable. In multiple documented cases, spyware has been used to silence dissent, locate and apprehend opposition leaders, journalists, and activists, and, in extreme cases, enable extrajudicial killings. These abuses, once confined to authoritarian regimes, are now being reported globally. Even in democratic nations, spyware has been deployed in ways that circumvent legal frameworks, raising concerns about the erosion of privacy and civil liberties.

It is essential to recognize that spyware did not create state-led repression and surveillance; these have existed for centuries. However, spyware makes it exponentially easier for states to engage in these practices at a scale previously unimaginable. The technology enables governments to infiltrate the most secure devices, making it easier to surveil citizens even beyond their national borders. Such unchecked access facilitates a wide range of human rights abuses, including harassment, imprisonment, and targeted killings.

Despite this, spyware is still often framed as a necessary evil—an essential component of state security. The truth, however, is that few governments have taken steps to demonstrate the legitimate, transparent uses of these technologies. Even fewer have implemented mechanisms to limit their misuse. As such, the available public data skews heavily toward documented abuses rather than any potential benefits.

Spyware and National Security Risks

The rapid proliferation of spyware presents a significant national security risk. As spyware becomes more accessible, states become increasingly capable of engaging in cyber espionage and disruptive cyber operations. These capabilities are often acquired without the necessary oversight or restraint, resulting in a landscape where states are more prepared for aggressive cyber operations than for the protection of their citizens’ rights.

The unregulated expansion of spyware markets has been recognized as a policy challenge, prompting efforts in Europe, the United States, and the United Kingdom to address the issue. However, these regulatory attempts have thus far been insufficient. The international nature of the market complicates efforts to impose meaningful oversight, allowing spyware vendors to operate with little accountability, often in countries with lax regulatory environments.

Historical Context: Dual-Use Technologies and Export Controls

The sale and export of spyware fall under the category of dual-use technologies, meaning they can serve both military and civilian purposes. International efforts to regulate dual-use technologies date back to 1996, when the Wassenaar Arrangement was established. This multilateral export control regime initially focused on conventional arms and technologies with military applications but was expanded in 2013 to include “intrusion software” like spyware. While this was a step forward, the language of the Wassenaar Arrangement was criticized for its vagueness, and many loopholes remained, allowing spyware vendors to continue operating with relative impunity.

The European Union implemented the Dual-Use Regulation in 1994, which has undergone significant revisions to modernize its export control regime. However, despite these efforts, EU member states are permitted to introduce additional restrictions based on human rights concerns, leading to a patchwork of regulations that fail to address the global nature of the spyware market.

In the United States, the Bureau of Industry and Security (BIS) within the Department of Commerce regulates dual-use exports. This includes placing companies that pose a threat to national security on the BIS Entity List, which requires them to obtain special licenses before they can export goods. In 2021, the BIS added several spyware vendors to this list, including the infamous NSO Group and Candiru Ltd. By 2023, companies associated with the Intellexa Consortium were also included, reflecting growing recognition of the need to control the spyware market.

Recent Developments: The Push for Stronger Regulation

In response to the growing concerns over spyware misuse, several recent policy initiatives have aimed to curb the proliferation of spyware. In March 2023, the United States took a significant step by prohibiting government agencies from using commercial spyware that poses a national security threat. This move was part of Executive Order 14093, issued by the Biden administration. Additionally, the US Department of Treasury has levied sanctions against key players in the spyware industry, including Intellexa and Cytrox, signaling a commitment to holding these entities accountable for their actions.

The international community has also begun to recognize the risks posed by spyware. In 2023, several countries signed the Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware. This multilateral agreement represents a growing consensus on the need for collective action to address the threats posed by spyware. However, while these efforts are commendable, they remain in their infancy, and much more needs to be done to ensure that these technologies are regulated effectively.

Despite these initiatives, there is still no consensus on how to balance the legitimate uses of spyware with the need to protect human rights. The lack of clear guidelines on what constitutes legitimate use leaves a significant gap in the regulatory framework, making it difficult to impose meaningful restrictions on the sale and use of spyware.

The Role of Non-State Actors: Civil Society and Investigative Journalism

While governments have been slow to address the spyware problem, civil society organizations and investigative journalists have played a crucial role in exposing abuses. Organizations like AccessNow and Amnesty International have been at the forefront of documenting spyware-related human rights violations, often providing the only public evidence of its misuse. The Pegasus Project, a collaborative investigation by a group of international journalists, brought global attention to the extent of spyware abuses, revealing how NSO Group’s Pegasus software was used to target journalists, human rights activists, and political dissidents.

These revelations have sparked public outrage and led to calls for greater accountability from governments and spyware vendors alike. However, despite the attention generated by these investigations, there has been little in the way of concrete policy changes. Governments continue to rely on spyware for intelligence and law enforcement purposes, often without implementing the necessary safeguards to prevent abuse.

The Future of Spyware Regulation: Challenges and Opportunities

As spyware technology continues to evolve, so too will the challenges associated with regulating it. The rapid pace of technological innovation makes it difficult for regulatory frameworks to keep up, and the global nature of the spyware market means that efforts to control its proliferation must be coordinated across borders. This is a daunting task, given the varying levels of commitment among governments to protecting human rights and privacy.

However, there are opportunities for progress. The growing recognition of the risks posed by spyware has prompted increased attention from policymakers, and recent efforts to impose sanctions and export controls on spyware vendors are a step in the right direction. Furthermore, the involvement of civil society organizations and investigative journalists in exposing spyware abuses has helped to create a public demand for greater transparency and accountability.

Moving forward, it will be crucial for governments to adopt a more holistic approach to regulating spyware. This will require not only stronger export controls and sanctions but also the development of international norms and standards for the use of spyware. Additionally, governments must work to improve transparency in their own use of spyware, providing clear guidelines on what constitutes legitimate use and ensuring that these technologies are used in a manner that respects human rights and privacy.

Building the Dataset

The dataset underpinning this analysis offers a significant, though not exhaustive, insight into the global spyware market. It sheds light on vendors and suppliers involved in the production, sale, and distribution of spyware technology. This record focuses on entities where public documentation exists, such as corporate registrations, that explicitly links them to spyware development or its components. Publicly available records form the basis of the research, ensuring that each entity listed has been independently verified through multiple sources. This methodology ensures a robust foundation for understanding the broader trends in the spyware industry, though gaps remain due to the secretive nature of many vendors.

The dataset development began by identifying high-visibility vendors through reports from established civil society organizations such as Amnesty International and Citizen Lab, alongside investigative reports from media outlets. Once identified, the research team cross-referenced these vendors with publicly available corporate and transaction records. The goal was to create detailed profiles that included not only the vendors themselves but also their subsidiaries, investors, and suppliers. Each entity was required to be corroborated by at least two independent sources, providing a solid basis for the dataset’s integrity.

The dataset covers activities of spyware vendors from their founding through 2023, offering a comprehensive look at the market’s evolution. However, the data remains incomplete, given the secretive operations of many entities and the opaque nature of their transactions.

Defining Entities in the Spyware Market

The spyware industry is a complex network of vendors, suppliers, and investors, all operating across multiple jurisdictions. The dataset identifies 435 entities, encompassing both vendors and suppliers, and reveals a pattern of cross-border relationships that shape the market’s global character. These entities are predominantly concentrated in three countries: Israel, India, and Italy—each of which plays a significant role in the development and sale of spyware technology.

The data suggests that the spyware market thrives in jurisdictions with a combination of technological expertise, limited regulatory oversight, and, in some cases, government support. These factors enable the continued proliferation of spyware, often with little regard for the human rights abuses that frequently follow its deployment.

The Three I’s: Israel, India, and Italy

The dataset reveals a notable concentration of spyware vendors and associated entities in Israel, India, and Italy, collectively accounting for over 65% of the total entities identified. This concentration is significant not only because of the size of these clusters but also due to the nature of their activities and the geopolitical implications of their operations.

• Israel: The Israeli spyware industry is by far the largest and most prominent in the dataset, with eight vendors accounting for 43.9% of the identified entities. Companies such as NSO Group, SaitoTech (formerly Candiru Ltd), Cognyte, and Paragon Solutions are among the key players in this market. Israel’s prominence in the spyware industry is partly due to its highly developed tech sector, combined with lax regulatory oversight that allows these companies to operate with minimal restrictions. The Israeli government has historically maintained close ties with many of these vendors, providing both direct and indirect support.
• India: India accounts for 7.8% of the entities in the dataset, with five major vendors and one key supplier. Companies such as Aglaya Scientific Aerospace Technology Systems Private Limited and BellTroX Infotech Services Private Ltd. play an active role in the global spyware market, often operating in legally grey areas. India’s role in the spyware market reflects its growing technological capabilities, though it also highlights the lack of effective regulatory controls over the sale and deployment of such technologies.
• Italy: Italy contributes 13.6% of the entities in the dataset, with six vendors and one supplier. Notable companies such as Memento Labs (formerly Hacking Team) and RCS ETM Sicurezza S.p.A. have long been involved in the development and sale of spyware. Italy’s role in the spyware market is especially notable given its position within the European Union, where debates continue about how to regulate the use and sale of such technology.

The dominance of these three countries in the dataset underscores the need for coordinated international efforts to regulate spyware. Their outsized role in the global market has significant implications for global security and human rights, particularly in light of ongoing abuses associated with the use of these technologies.

Images source :source :https://dfrlab.org/

Serial Entrepreneurs: The Growth of Spyware Clusters

Another striking feature of the spyware market is the prevalence of serial entrepreneurs—individuals who repeatedly establish and lead multiple spyware companies. This trend is particularly evident in Israel, where several former employees of established vendors have gone on to found new firms, often carrying over key clients and technological expertise.

This phenomenon is not unique to Israel. In India, for example, the founders of BellTroX Infotech Services Private Ltd. previously worked at Appin Security Group, another spyware vendor implicated in numerous hacking-for-hire schemes. The fluid movement of talent and expertise between firms allows for the rapid dissemination of spyware technologies, often making it difficult for regulators to keep pace with emerging threats.

The dataset reveals that, on average, founders of spyware vendors are involved in 2.2 companies over the course of their careers. This high degree of mobility suggests that the industry is characterized by a tight-knit network of individuals who leverage their expertise across multiple ventures. The result is an ecosystem where the same individuals and entities are responsible for much of the spyware market’s growth.

Image :  Employees frequently make the jump from employee to founder – source :https://dfrlab.org/

The NSO Group Cluster: A Case Study

The NSO Group is perhaps the most well-known example of serial entrepreneurship within the spyware market. Founded in 2010 in Israel, the company has become synonymous with spyware through its flagship product, Pegasus. Despite numerous investigations and sanctions, the NSO Group continues to operate across multiple jurisdictions, including the United States and Luxembourg. The company has also spawned several spin-offs, with former employees founding new firms that continue to develop and sell spyware.

One such firm is Quadream Inc., founded in 2016 by former NSO employees Guy Geva and Nimrod Reznik. Like NSO, Quadream has developed its own spyware product, known as Reign, which has been sold to various governments for surveillance purposes. Another notable example is Interionet Systems Ltd., founded by former NSO employees Yair Pecht and Sharon Oknin. Interionet specializes in developing malware for internet routers and has secured contracts with law enforcement agencies in multiple countries.

The interconnected nature of these companies highlights the challenges associated with regulating the spyware market. Even as sanctions are imposed on one firm, new companies often emerge, led by the same individuals who previously worked for the sanctioned entity. This creates a perpetual cycle of proliferation, making it difficult to curb the spread of these technologies.

Image: Mapping connections in the NSO Group, Quadream, and Interionet clusters – source :https://dfrlab.org/

Indian Spyware Market: A Parallel Growth Story

In India, the spyware market has followed a similar trajectory, with serial entrepreneurs founding multiple companies that offer hack-for-hire services. The Appin Security Group, established by Rajat Khare and his brother Anuj, has been implicated in numerous cyber espionage cases, targeting individuals and organizations worldwide. Former employees of Appin have gone on to found their own companies, including BellTroX Infotech Services Private Ltd., which has been linked to a number of high-profile hacking incidents.

The dataset reveals that the Indian spyware market, while smaller than Israel’s, is nonetheless significant. Indian vendors and suppliers have established a reputation for offering low-cost, high-impact spyware solutions, making them attractive to both government and non-state actors. However, like their Israeli counterparts, these companies often operate in legal grey areas, with little oversight or accountability.

Image: Mapping connections in the Appin Security Group and BellTrox Infotech Services Private Ltd Clusters – source :https://dfrlab.org/

Corporate Structures and Jurisdictional Shifts

One of the more concerning trends identified in the dataset is the deliberate shifting of corporate structures across jurisdictions. Many spyware vendors have adopted a strategy of relocating their operations to countries with more favorable regulatory environments, allowing them to continue their activities with minimal oversight. This trend is particularly evident in Israel, where several vendors have established subsidiaries in countries such as Cyprus and Bulgaria, both of which have more lenient regulations on the sale of surveillance technology.

This deliberate movement of corporate entities complicates efforts to regulate the spyware market. Vendors can easily relocate their operations to avoid sanctions or other legal restrictions, making it difficult for policymakers to impose meaningful controls on the industry. The ability of these companies to operate across borders also highlights the need for coordinated international efforts to regulate spyware, as unilateral actions by individual countries are unlikely to be effective.

Cross-Border Mobility of Capital

The spyware market is not only defined by the mobility of its talent but also by the cross-border flow of capital that supports its growth. The dataset reveals a significant degree of foreign investment in spyware vendors, particularly from venture capital firms and private equity groups. This investment often comes from countries with little to no regulation of surveillance technologies, further enabling the proliferation of spyware.

The global nature of the spyware market means that efforts to curb its growth must also address the financial networks that support it. Policymakers should consider implementing stricter regulations on investments in spyware firms, particularly those with a history of human rights abuses. By targeting the flow of capital, governments can disrupt the financial incentives that drive the continued development and sale of spyware technologies.

In conclusion, the dataset provides a crucial window into the global spyware market, revealing the complex web of vendors, suppliers, and investors that sustain it. The trends identified—concentration in certain jurisdictions, the prevalence of serial entrepreneurs, corporate restructuring to evade regulation, and the cross-border mobility of capital—underscore the need for a coordinated, international response to address the proliferation of spyware. Only through concerted action can the risks posed by these technologies be mitigated, protecting both national security and human rights.

Partnership with Hardware Surveillance

The dataset reveals an intriguing pattern of partnerships between spyware vendors and hardware-based surveillance companies, which together form a more comprehensive toolset for governments and other buyers. These partnerships often involve collaborations where spyware tools are integrated with hardware systems that enable long-range interception or passive surveillance, enhancing the overall capacity of these spyware solutions. This section focuses on the documented partnerships and the implications they have for understanding the broader spyware market.

A notable example of these partnerships is the Intellexa Consortium, a group of companies that includes Cytrox AD, WS WiSpear Systems Limited, and Senpai Technologies Ltd, among others. Formed by Tal Dilian in 2018, the Intellexa Consortium is one of the most active entities in the dataset when it comes to hardware-surveillance partnerships. For example, WS WiSpear Systems specializes in intercepting Wi-Fi signals, while Senpai Technologies focuses on analyzing data from devices infected with spyware. Together, these companies offer a comprehensive solution for customers seeking both hardware-based interception tools and sophisticated spyware capabilities.

Additionally, Intellexa’s collaboration with the Nexa Group, which includes four other companies, created a broader Intellexa Alliance. This collaboration allowed the two entities to market a wider range of interception technologies as a packaged solution, further blurring the line between spyware and hardware surveillance. Although it remains unclear whether the Intellexa Alliance is still operational due to reported tensions between the partners, this example highlights the strategic partnerships that define much of the spyware market.

The dataset also uncovers similar patterns in the Italian market, particularly in the case of Memento Labs (formerly Hacking Team), which partnered with the South African firm VASTech to create wireless interception tools. VASTech, founded by Frans Dreyer, has played a significant role in the surveillance market, particularly through its work in South Africa, Switzerland, and the UAE. The partnership between VASTech and Memento Labs is a key example of how spyware vendors collaborate with hardware companies to expand their capabilities and market reach.

These examples underscore the importance of regulating not just spyware vendors, but also their hardware partners. Together, these firms form a web of interconnected actors whose products can be used for surveillance purposes that may violate human rights or undermine national security. Effective regulation must address this broader network of entities, as targeting spyware vendors alone will not adequately curb the misuse of surveillance technologies.

Image: Mapping connections in the Intellexa Consortium and Nexa Group clusters

Shifting Vendor Identities

The phenomenon of spyware vendors changing their legal names or corporate structures to evade scrutiny or regulatory action is a recurring theme in the dataset. These identity shifts serve multiple purposes: they obscure the vendor’s history, protect the company from the fallout of negative media reports, and allow them to continue their activities under a different guise. This trend is widespread in the spyware industry, complicating efforts to track and regulate these entities effectively.

On average, vendors in the dataset changed their names more than once, with an average of 1.4 name changes per company. These changes often occur without significant alterations to the company’s structure, meaning the same individuals and investors continue to run the business. Vendors use these name changes as a way to manage their reputational risks while maintaining operations.

A prime example of this behavior is the company formerly known as Candiru Ltd, which changed its name four times over nine years. Now operating as Saito Tech Ltd, this vendor has continued to sell spyware to governments despite being blacklisted by the US government. Candiru’s frequent name changes are a deliberate strategy to evade the consequences of negative press and regulatory action while continuing to engage in the same business activities. The company’s involvement in selling spyware to Hungary, Spain, and the UAE, where it was used to suppress political opposition, highlights the dangers posed by vendors who operate with little oversight.

Another prominent example is Memento Labs srl, which was known as Hacking Team srl for sixteen years before rebranding itself in 2019. Hacking Team srl was widely criticized after its spyware was linked to human rights abuses in multiple countries, including Ecuador, Nigeria, and Saudi Arabia. The company’s 2015 data breach, which exposed its internal communications, further damaged its reputation. Despite these setbacks, Hacking Team srl managed to continue its operations, eventually rebranding itself as Memento Labs srl in an effort to distance itself from its controversial past.

Image: Mapping connections between Hacking Team srl and VASTech clusters

This trend is not limited to Israeli or Italian vendors. The Indian company Appin Security Group also went through several name changes, evolving from Appin Technology Ltd. to a series of unrelated names such as Mobile Online Order Management Private Limited and Sunkissed Organic Farms. These changes reflect a pattern of rapidly shifting identities designed to avoid scrutiny while maintaining business operations. In each case, the core leadership and business model of the company remained the same, but the frequent name changes created confusion and obscured the company’s activities.

The dataset also highlights the case of Equus Technologies, which changed its name to MerlinX after a damaging report from Google linked the company to the development of the spyware software Lipizzan. The negative publicity led to customer losses and shareholder withdrawals, forcing the company to rebrand itself. In 2021, MerlinX was acquired by Bindecy, another Israeli company specializing in vulnerability research. This case demonstrates how name changes, acquisitions, and mergers are used as tools to obscure a company’s identity and manage the fallout from negative reporting.

The practice of frequent name changes complicates efforts to regulate the spyware market. Researchers, policymakers, and potential investors face significant challenges in tracking these companies, as their shifting identities make it difficult to connect a vendor’s past activities with its current operations. This allows vendors to continue their work relatively undisturbed, even in the face of regulatory actions or public outcry.

To counter this trend, there is a growing need for policies that emphasize greater transparency and accountability. One potential solution is the introduction of mandatory “Know Your Vendor” requirements, which would require companies purchasing spyware to disclose the full range of suppliers and partners involved in the development of the technology. This would help create a more transparent supply chain and allow for better regulation of both the vendors and their associated entities.

Additionally, corporate registries should improve their transparency and make it easier to track entities across jurisdictions. Currently, many spyware vendors take advantage of the lack of coordination between national registries to obscure their operations. By creating a more unified and accessible system for tracking corporate entities, policymakers can more effectively monitor the activities of spyware vendors and their partners, regardless of how frequently they change their names or structures.

The dataset clearly shows that name changes and shifting corporate identities are a common strategy within the spyware market. Addressing this issue will require a coordinated effort from regulators, civil society organizations, and governments to ensure that vendors cannot simply rebrand themselves out of accountability. By focusing on both the vendors and their investors, and by improving the transparency of corporate registries, it may be possible to reduce the proliferation of spyware and limit the harm it causes to human rights and national security.

Strategic Jurisdiction Hopping

Several spyware vendors and suppliers identified in the dataset exhibit a deliberate strategy of crossing jurisdictional boundaries, establishing subsidiaries, branches, and partnerships in multiple locations to gain access to favorable markets or regulatory environments. This practice, often referred to as “jurisdiction hopping,” provides significant advantages to vendors by allowing them to navigate different legal frameworks, evade scrutiny, or exploit loopholes in export control laws.

In 2017, the Israeli vendor Quadream Inc. took a strategic step to expand its presence in the European market by establishing a supplier, InReach Technologies Limited, in Cyprus. According to a later court filing, Quadream Inc. claimed that the “sole purpose” of setting up InReach Technologies was to promote Quadream’s products within the European Union. The choice of Cyprus as a base was likely influenced by the country’s relatively lenient regulatory framework, making it an attractive gateway for Israeli companies looking to access the EU market.

InReach Technologies Limited’s financial structure also included A.I.L Nominal Services Ltd. (A.I.L), another company established in Cyprus in 2010, serving as a holding entity. This connection is notable because one individual involved in A.I.L had a relationship with the Ministry of Defense, which potentially added layers of strategic and operational depth to the business relationship between Quadream Inc. and InReach Technologies.

However, by 2020, tensions began to surface between Quadream Inc. and InReach Technologies, resulting in a legal dispute between the two entities. The specific nature of the dispute remains undisclosed, but the strained relationship between the companies complicated their operational dynamics. Despite these tensions, there is no clear evidence from the available data whether the two companies formally separated before 2023.

In 2023, the Citizen Lab released a report exposing the capabilities of Quadream Inc., highlighting its spyware toolkit and raising serious ethical and legal concerns about its products. This public exposure further damaged the company’s reputation and led Quadream Inc. to announce that it would be shutting down its operations. Despite this announcement, the company remains officially registered in Israel, casting some uncertainty over its actual operational status.

Similarly, the Intellexa Consortium, under the leadership of Tal Dilian, utilized Cyprus as a key hub for its operations. Leaked documents revealed how Intellexa, which developed the Predator spyware, used Cyprus as a base to access the European market. By situating critical components of its operations in Cyprus, Intellexa was able to benefit from the jurisdiction’s relatively lax export controls while marketing its products to EU clients. This jurisdictional arbitrage strategy reflects a broader trend among spyware vendors to establish operational footholds in countries where legal frameworks are more permissive or less stringent.

Interestingly, Memento Labs (formerly Hacking Team), an Italian spyware vendor, presents a deviation from this trend. Instead of engaging in jurisdiction hopping, Memento Labs maintained a strictly Italian identity, with its operations and investor base primarily concentrated in Italy. The company’s founders took pride in their products being “Made in Italy,” even as Hacking Team’s spyware was linked to human rights abuses across the globe. While most vendors in the dataset strategically expanded their operations across borders, Memento Labs remained an outlier, emphasizing its national identity as a point of differentiation.

The deliberate construction of cross-border relationships—whether through subsidiaries, branches, or partnerships—serves to blur the lines between internal corporate activity and external market access. By positioning themselves in jurisdictions with more favorable legal environments, spyware vendors can evade restrictions that might otherwise limit their operations. This tactic complicates efforts to regulate the spyware market, as vendors can exploit the complexities of international law to continue their activities with minimal oversight.

Export controls, which are typically designed to regulate the sale of dual-use technologies like spyware, are often rendered ineffective by these jurisdictional maneuvers. Vendors can bypass restrictions in one jurisdiction by shifting key parts of their operations to another, creating a network of interlinked entities that are difficult to track and regulate. This practice of jurisdiction hopping not only reduces the efficacy of export controls but also increases the opacity of the spyware market, making it harder for regulators and policymakers to hold these companies accountable.

Money From Across the World Fuels the Spyware Market

The spyware market is not only shaped by the movement of vendors across jurisdictions but also by the flow of capital from investors domiciled in multiple countries. Investment in spyware vendors and suppliers is a critical, yet understudied, factor in the proliferation of these technologies. The dataset reveals that 95 investors have been identified as financially supporting spyware vendors and suppliers, with many of these investors located outside the vendors’ home countries.

Italy, Israel, the United States, and the United Kingdom are the most frequently represented jurisdictions among spyware investors, accounting for 46.3% of the identified investor base. This highlights the international nature of spyware investments, with capital flowing across borders to support vendors in different countries. The presence of investors from diverse jurisdictions further complicates efforts to regulate the spyware market, as financial support often originates from countries with little to no involvement in the development or sale of these technologies.

One of the most notable examples of cross-border investment in the spyware market is Paragon Solutions, an Israeli vendor founded in 2019. Paragon has aggressively sought to expand its presence in the US market, establishing a US-based subsidiary, Paragon Solutions US, and attracting two prominent US investors: Battery Ventures and Blumberg Capital. Both firms are well-established venture capital players, with Battery Ventures headquartered in Boston and Blumberg Capital based in San Francisco. This infusion of US capital has enabled Paragon to scale its operations and strengthen its foothold in the lucrative US market.

The flow of investment capital into the spyware market is not limited to venture capital firms. In some cases, spyware vendors are supported by government loans, private equity investments, or direct equity ownership by foreign entities. For instance, NSO Group, one of the most infamous spyware vendors, has received investment from a range of foreign entities, including the UK-based Novalpina Capital and the US-based Francisco Partners Management, Berkeley Research Group, and Blackstone Group LP. The international nature of NSO Group’s investor base underscores the global financial networks that fuel the spyware market.

The dataset also highlights the role of foreign investment in supporting smaller vendors like Saito Tech Ltd (formerly Candiru Ltd). Saito Tech received investment from the US-based Founders Group, illustrating how even less well-known vendors can attract foreign capital to support their operations. These cross-border capital flows create a web of financial relationships that can obscure the true sources of funding for spyware vendors, making it difficult to trace the origins of investment and hold investors accountable.

The presence of foreign investors in the spyware market raises important questions about the responsibility of investors in supporting companies that may be involved in human rights abuses or other unethical activities. While some investors may be unaware of the full extent of a vendor’s activities, others may choose to overlook these issues in pursuit of financial returns. This lack of transparency and accountability further complicates efforts to regulate the spyware market, as financial backing from foreign investors enables vendors to continue their operations even in the face of regulatory challenges.

To address these challenges, policymakers must focus on increasing transparency in both the investment process and the corporate structures of spyware vendors. In the US, recent moves to compel companies to disclose their beneficial owners represent a step in the right direction. This policy, aligned with similar efforts in other countries, aims to increase transparency in corporate ownership and prevent companies from using shell entities to hide their activities. For vendors located outside the US, the proposed extension of US security reviews to outbound investments could provide a mechanism for scrutinizing and potentially blocking investments that may support unethical activities in the spyware market.

Sanctions represent another potential tool for limiting the influence of investors in the spyware market. By targeting investors who support vendors involved in human rights abuses, governments can cut off financial lifelines that allow these vendors to continue their operations. This approach would require a more granular application of sanctions, focusing not only on the vendors themselves but also on the investors who provide them with capital.

In conclusion, the dataset highlights the critical role that cross-border capital flows play in sustaining the spyware market. Investors from diverse jurisdictions provide the financial backing that allows spyware vendors to develop, market, and sell their products across the globe. Without greater transparency and accountability in the investment process, the flow of capital into the spyware market will continue to fuel the proliferation of these technologies, further complicating efforts to regulate their use and mitigate their harmful effects on national security and human rights.

Policy Recommendations

The 2024 report by the Office of the National Cyber Director (ONCD) highlights the growing importance of addressing sophisticated cyber-surveillance tools in the global strategic environment. The United States, alongside the UK, France, and other governments, has begun focusing on the implications of spyware and cyber-intrusion capabilities through initiatives such as the Pall Mall Process. Similarly, the European Union has initiated policy measures via the PEGA committee to regulate spyware’s implications on human rights, national security, and technology. These developments signify a collective international push to address the threats posed by spyware, yet substantial work remains.

This section offers several detailed policy recommendations focused on improving transparency, limiting jurisdictional arbitrage, and scrutinizing the relationships between spyware vendors, suppliers, and investors. These suggestions aim to enhance regulatory oversight, foster international cooperation, and mitigate the harms resulting from the proliferation of spyware.

Mandate “Know Your Vendor” Requirements

A key challenge in regulating the spyware market lies in the difficulty of tracking vendor identities and supply chains, especially given the fluidity of vendor structures. To combat this, a practical solution would be the implementation of “Know Your Vendor” (KYV) requirements. These would compel spyware vendors to disclose their supplier and investor relationships, providing a clearer view of the market for government clients and potential purchasers. KYV could be enforced by countries that are signatories to initiatives such as the Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware.

KYV requirements should ensure vendors disclose their full supply chain, including their suppliers and investors. This transparency would allow governments to check if any entities involved in spyware development or sales are on restricted lists before awarding contracts. The KYV data would also provide valuable information for governments to ensure that public funds are not inadvertently supporting high-risk vendors. This system could further be enhanced by requiring the disclosure of relationships with firms that operate further down the supply chain, offering a broader view of how spyware tools are developed and sold.

In the United States, KYV requirements could be integrated into the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS). These requirements could ensure that any company bidding for government contracts related to cyber operations would need to disclose its vendor and supplier network, as well as its investor and parent company structure. This would be a critical step in improving due diligence and reducing the flow of government funds to vendors that operate in risky or opaque environments.

Improve Government-Run Corporate Registries

To complement KYV requirements, government-run corporate registries need significant enhancement to become effective tools for due diligence and oversight. Currently, these registries vary greatly by country in terms of the information they provide, with some offering detailed histories of company name changes and ownership structures, while others provide only basic data such as the company name, registration date, and legal status.

Expand the Minimum Scope of Data Captured by Registries

Corporate registries should capture a wider range of data, including company ownership details, financial statements, history of mergers and acquisitions, and information on key employees. This expanded scope would allow for a deeper understanding of the vendors operating in the spyware market and improve the ability of investors, governments, and civil society to perform due diligence.

In the United States, the National Association of Secretaries of State (NASS) could issue guidelines to improve the consistency of data captured across the fifty state corporate registries. Alternatively, the Internal Revenue Service (IRS) could play a role in collecting and publishing this data for federal purposes, ensuring a more comprehensive view of corporate structures.

Expand Beneficial Ownership Identification

In January 2024, the U.S. Department of Treasury launched its Beneficial Ownership Program (BOP), aimed at improving transparency by identifying the individuals who ultimately own or control companies. However, most countries do not have similar beneficial ownership reporting requirements. Expanding these programs globally would help to identify the true owners behind spyware vendors and ensure that investors and suppliers are held accountable for their activities.

Countries that have not implemented beneficial ownership programs should be encouraged to do so, harmonizing their approaches with global best practices. The Financial Action Task Force (FATF) and the OECD’s Global Forum on Transparency and Exchange of Information for Tax Purposes have already endorsed such measures, which would further limit jurisdictional arbitrage by spyware vendors.

Make Government-Run Corporate Registry Data Public

Public access to corporate registry data is essential for ensuring transparency. Open access to this information would allow civil society, researchers, and journalists to hold companies accountable for their actions. Countries with closed or restricted corporate registries should be encouraged to make this data freely available to the public. In doing so, they would empower stakeholders to scrutinize spyware vendors and investors more effectively.

Enrich, Audit, and Publish Export Licenses

Export licenses for spyware are a critical regulatory tool that allows governments to control the sale and use of surveillance technologies. However, these licenses are often opaque, and many governments fail to conduct regular audits to ensure compliance. Strengthening export licensing regimes would provide a more effective mechanism for regulating spyware vendors.

Include Employee Information in Export Licenses

One way to strengthen export licensing is to require that all employees who have a material impact on the development of spyware products be listed on the export license. This would create a public record of the individuals involved in spyware development, helping to deter risky behavior and ensuring that vendors cannot simply change their names to avoid scrutiny.

Conduct Mandatory and Regular Audits

Governments should introduce mandatory audits for export licenses to ensure that spyware vendors are complying with their obligations. Regular audits would allow governments to monitor the activities of vendors and revoke licenses if evidence of abuse or misuse of spyware emerges. This auditing process would provide an additional layer of accountability and ensure that export licenses remain a meaningful regulatory tool.

Publish Export License Data

Export license data should be made public, with appropriate redactions to protect sensitive information. This transparency would allow civil society and researchers to hold vendors accountable and ensure that governments are not licensing spyware to countries or entities that may use it for human rights abuses.

Limit Jurisdictional Arbitrage by Vendors

Vendors often exploit differences in regulatory frameworks between countries to engage in jurisdictional arbitrage, setting up subsidiaries or branches in jurisdictions with lenient export controls. To address this issue, governments should require vendors to publicly disclose any new subsidiaries or branches they establish. This would limit their ability to evade regulatory oversight and ensure that governments can track their operations more effectively.

In addition, governments should scrutinize changes in the ownership structure of spyware vendors, automatically reviewing any mergers or acquisitions that impact domestic vendors. Failure to disclose these transactions should result in penalties, including the suspension of export licenses or exclusion from government contracts.

Provide Greater Protection Against Strategic Lawsuits Against Public Participation (SLAPP)

The spyware industry has increasingly relied on Strategic Lawsuits Against Public Participation (SLAPP) to silence journalists and researchers who investigate their activities. SLAPP suits are a dangerous tool used to intimidate those who provide transparency into the spyware market. Governments should take steps to protect journalists and researchers from such lawsuits, including the introduction of accelerated legal processes for dismissing SLAPP suits and the imposition of penalties on companies that file these suits.

The European Commission’s 2024 rules to protect speech on matters of public interest provide a useful template for other countries. These rules include provisions for the early dismissal of SLAPP suits, compensation for defendants, and penalties for plaintiffs. Adopting similar protections in the United States and other countries would safeguard the work of journalists and researchers and ensure that the spyware industry cannot use legal threats to evade scrutiny.

Areas for Future Work

The recommendations outlined so far focus on key areas like transparency, regulatory scrutiny, and limiting jurisdictional arbitrage. However, many other critical aspects of the spyware market remain underexplored, offering opportunities for further research and policy development. The following areas require greater attention and action to advance the broader goal of regulating the proliferation of spyware technologies and mitigating the risks associated with their misuse.

Bringing the Brokers Back In

An underexamined part of the spyware market is the role of exploit brokers—firms that operate at the intersection of information traffic, talent acquisition, and software vulnerabilities. While these brokers do not always produce or sell spyware themselves, they are a critical link in the broader ecosystem, often providing necessary components like vulnerabilities or exploit frameworks to vendors. This dataset lacks sufficient data on these brokers, highlighting the need for more comprehensive research into their operations, geographical distribution, and business relationships.

These brokers often exist in a gray area, where their activities are not inherently malicious but are pivotal to the supply chain that ultimately enables the development of harmful spyware. Policymakers must strike a delicate balance when regulating exploit brokers, ensuring that they do not stifle legitimate cybersecurity research while minimizing the risks posed by exploit trafficking. A better understanding of the relationships between brokers, vendors, and suppliers could shed light on the ways in which this segment of the market drives the proliferation of spyware.

Spyware Vendors or Suppliers Partnered with Major Tech Firms

The intersection of spyware vendors and mainstream technology firms poses another area of concern. Some spyware companies have established partnerships with major technology players like Microsoft and Samsung, primarily in the context of vulnerability disclosure. Positive Technologies, for instance, was previously a member of Microsoft’s Active Protections Program (MAPP). These collaborations underscore the dual-use nature of vulnerability discovery and exploitation, where the same vulnerabilities may serve both offensive and defensive purposes.

The collaboration between conventional technology companies and spyware vendors raises ethical and legal concerns. It blurs the boundaries between legitimate cybersecurity practices and the development of tools used for mass surveillance and human rights violations. Future work should investigate the structure of these partnerships, especially in terms of how they influence the dissemination of vulnerabilities and contribute to spyware’s offensive capabilities. Understanding the full scope of these partnerships would help policymakers design more targeted interventions to prevent the misuse of vulnerabilities for surveillance purposes.

A “Who’s Who” for Spyware Investors

The role of investors in the spyware industry remains underexplored. Although the dataset includes information on various venture capital firms and private equity investors, the motivations driving these investments are not well understood. In conventional markets, venture capital and private equity have distinct investment strategies, but their roles in the spyware sector are less clear.

Developing a more robust due diligence framework for investors requires a deeper understanding of why certain investors choose to back spyware vendors. For example, venture capital firms might be more interested in high-growth opportunities, while private equity investors may seek longer-term returns. Clarifying these distinctions could inform the development of more effective investor regulations, aimed at reducing the flow of capital to companies involved in unethical activities. Future research should focus on identifying the types of investors active in the spyware market and understanding their incentives.

The Customer Might Often Be Wrong

One critical aspect that remains unaddressed is the role of government customers in shaping the spyware market. These customers, which include government agencies, security services, and law enforcement bodies, are the primary consumers of spyware technologies. Their purchasing decisions, contractual relationships, and behavior largely determine the demand for spyware products.

Further work is needed to catalog these government customers, map their relationships with vendors, and examine the timing of their contracts. This would provide insight into how these relationships form and whether they encourage market consolidation or competition. Additionally, analyzing the portability of customer relationships across vendors could reveal patterns in how governments switch between different spyware providers. Understanding the customer side of the market is essential for crafting policies that address not only the supply of spyware but also its demand.

A Role for Technology Companies

Technology companies are uniquely positioned to influence the spyware market, given that many spyware vendors rely on their services. For example, the NSO Group has been documented using Amazon Web Services (AWS) to manage its spyware infrastructure. Major cloud service providers and technology companies have a responsibility to ensure that their products are not being used to facilitate human rights abuses or unlawful surveillance.

Tech companies could play a proactive role in shaping the future of the spyware market by implementing more rigorous due diligence processes. These processes would involve screening customers for connections to the spyware market and, where necessary, denying services to high-risk actors. Additionally, major technology firms could collaborate to develop a common code of conduct for providing services to spyware vendors, ensuring consistent standards across the industry. Such efforts would help mitigate the risk of tech companies unwittingly supporting malicious actors in the spyware ecosystem.

Whistleblowers

Whistleblowers have historically played a critical role in exposing the misuse of spyware technologies, but their legal status and protections remain unclear. Whistleblowers within spyware vendors or government customers often face significant legal and personal risks, especially in jurisdictions that lack robust whistleblower protections.

There is a pressing need for consolidated guidance on how whistleblowers in the spyware industry can safely come forward. This guidance should clarify the ethical and legal responsibilities of both vendors and customers, ensuring that individuals who expose abuses have adequate protection from retaliation. Future research should explore the legal frameworks necessary to protect whistleblowers in the context of national security, human rights, and corporate governance.

Clarifying De-Listing Procedures

Sanctions are an essential tool for shaping the behavior of spyware vendors, but there is currently little clarity around the processes for de-listing sanctioned entities. Sanctions are intended to incentivize behavior change, and companies or individuals that demonstrate meaningful improvements in their practices should be eligible for removal from sanctions lists.

Governments and multilateral organizations should establish clear, transparent criteria for de-listing sanctioned entities. This would ensure the credibility of sanctions regimes and provide a path for companies to reform their practices. Researchers and advocates can play a key role in mapping out these processes and ensuring that they are applied consistently.

What Comes Next

The increased regulation of the spyware market raises the question of how vendors will respond, particularly whether they will shift operations to jurisdictions with weaker regulatory frameworks. Jurisdictional arbitrage, already observed in this market, may accelerate as more states adopt stringent regulations. Understanding how and where vendors might relocate, and how that could fragment the market, is critical for anticipating future trends.

While vendors may move to jurisdictions with fewer regulatory controls, their reliance on foreign capital and suppliers provides an opportunity for continued pressure. Even vendors operating in hard-to-reach locations often depend on investors and suppliers based in countries with strong regulatory frameworks. By targeting these relationships, governments can exert influence over vendors regardless of their geographical location.

The Global Battlefield of Cyber Espionage: Spyware and Cyber Surveillance Capabilities in the U.S., China, and Russia

The 21st century has ushered in a new form of warfare, one that operates in the unseen realm of cyberspace. The quiet conflict over information and control is driven by powerful nations that have invested heavily in sophisticated cyber-espionage and surveillance tools to exert influence, control, and to protect their national security interests. The key players in this evolving global theater are the United States, China, and Russia. Each nation has developed a web of technologies, companies, and covert programs designed to exploit vulnerabilities in digital infrastructure. At the center of this landscape is spyware—software capable of infiltrating telephones, computers, and other digital devices. Spyware enables unprecedented control over information, communication, and surveillance activities.

This article explores the intersection of governmental policy, corporate development, and technological capabilities in the spyware industries of the U.S., China, and Russia. It is a detailed and structured examination of the major players, significant technologies, and strategic objectives pursued by these powerful nations.

The United States: Leadership in Cyber Intelligence and Covert Operations

Governmental Programs and Agencies

The U.S. has long been at the forefront of cyber-espionage, with many of its capabilities centered around the National Security Agency (NSA), the Central Intelligence Agency (CIA), and specialized branches within the Department of Defense. In the aftermath of 9/11, the Patriot Act broadened the government’s surveillance capabilities, leading to the development of sophisticated spyware and cyber-surveillance programs.

The NSA’s surveillance capabilities were famously exposed by former contractor Edward Snowden, who revealed the agency’s widespread data-gathering activities. Programs such as PRISM allowed the U.S. government to access the private communications of individuals by working with major tech companies like Google, Microsoft, and Facebook. These revelations highlighted the integration of national security efforts with the private sector in order to enhance surveillance capacities, especially within the United States.

Another key element of the U.S. approach to cyber-espionage is the Tailored Access Operations (TAO) division of the NSA, which specializes in infiltrating foreign computer networks. Through custom-designed spyware and offensive cyber tools, the U.S. has conducted extensive intelligence-gathering missions. TAO, working alongside the CIA’s Center for Cyber Intelligence (CCI), is also involved in cyber-offensive operations. A notable example is the development of the Stuxnet worm, which targeted Iran’s nuclear facilities. Developed in partnership with Israel, Stuxnet was a prime example of how spyware could be used to sabotage critical infrastructure in hostile states.

Key U.S. Companies and Technologies

Several American companies have developed tools and platforms used by both the private sector and the government for surveillance purposes. These companies are closely intertwined with U.S. intelligence agencies, supplying critical tools for both offensive and defensive cybersecurity operations.

• Palantir Technologies
  • Founded by Peter Thiel and Alex Karp, Palantir has developed sophisticated data-mining software used by the NSA, FBI, CIA, and other government agencies. The company’s platforms, Gotham and Foundry, are known for their ability to aggregate vast amounts of data for intelligence purposes, including real-time surveillance.
• CrowdStrike
  • CrowdStrike gained prominence following the high-profile cyber-attacks against the Democratic National Committee (DNC) during the 2016 U.S. presidential election. The company’s platform focuses on threat detection, and its Falcon product is capable of identifying and neutralizing advanced spyware used by foreign governments.
• Boeing’s Argon ST
  • Boeing, a defense contractor, has developed several cyber-surveillance tools under its subsidiary Argon ST. These tools are used by the U.S. government to conduct electronic warfare and cyber-intelligence operations, especially in the realm of signal intelligence (SIGINT) and electronic countermeasures.

U.S. Cyber Capabilities and the International Arena

The U.S. remains a dominant player in the global spyware market, but it also seeks to control the proliferation of such technologies. Export controls under the Wassenaar Arrangement restrict the sale of certain dual-use technologies, including spyware, to countries that are considered potential adversaries. However, U.S. allies, such as the United Kingdom, Israel, and certain NATO members, benefit from American cyber technology and cooperation.

At the same time, the U.S. government has launched targeted sanctions against spyware vendors like NSO Group (an Israeli company) due to concerns over the misuse of surveillance tools like Pegasus spyware. By sanctioning these companies, the U.S. seeks to influence global norms regarding the ethical use of spyware, while protecting its own cyber interests.

China: The Emerging Power in Cyber Surveillance

Governmental Programs and Objectives

China’s approach to cyber-surveillance is distinctly different from that of the U.S., focusing heavily on domestic control as well as international espionage. The Chinese government views cybersecurity and surveillance as an essential part of maintaining state control over its population and expanding its influence globally. The People’s Liberation Army (PLA) and the Ministry of State Security (MSS) are central players in China’s cyber-espionage apparatus.

China’s cyber capabilities have been strengthened through its National Intelligence Law of 2017, which requires all Chinese companies to cooperate with state intelligence operations. This legal framework has led to the state’s ability to access and control data from companies such as Huawei, ZTE, and Alibaba.

Domestically, China’s surveillance state has been bolstered by the Golden Shield Project and its successor, the Social Credit System. These projects enable mass surveillance of Chinese citizens through a combination of advanced spyware, facial recognition, and data analysis, all under the guise of maintaining social stability.

Key Chinese Companies and Technologies

Several Chinese companies have developed and exported spyware and surveillance technologies globally. These firms are often state-sponsored or heavily influenced by the government, which allows for seamless integration of their technologies into Chinese intelligence operations.

• Huawei Technologies
  • Huawei has been at the center of controversies regarding its alleged involvement in espionage activities. The company’s telecommunications infrastructure has been used as a platform for Chinese cyber operations, with some Western governments banning Huawei products due to national security concerns. Huawei’s 5G infrastructure has also been scrutinized for its potential use in mass surveillance.
• ZTE Corporation
  • ZTE, another major Chinese telecommunications company, has been implicated in providing surveillance tools to authoritarian regimes, such as Iran and North Korea. The company’s involvement in facilitating government-backed spyware operations has made it a target of U.S. sanctions.
• Baidu
  • China’s leading search engine, Baidu, has played a significant role in developing artificial intelligence (AI) and machine learning tools for surveillance purposes. Baidu’s AI platforms are used by the Chinese government to analyze vast amounts of data collected from its citizenry, facilitating predictive surveillance techniques.
• Qihoo 360
  • Known for its anti-virus software, Qihoo 360 has been implicated in the development of spyware tools and has been linked to Chinese government hacking campaigns. The company’s research division also plays a significant role in discovering zero-day vulnerabilities, which are then exploited by Chinese state-backed hackers.

China’s Global Cyber Ambitions

China’s ambition to dominate the global cyber-surveillance market is evident through its Belt and Road Initiative (BRI), which extends beyond physical infrastructure projects to include the construction of digital infrastructure. Chinese companies, including Huawei and ZTE, are instrumental in building surveillance networks in countries across Africa, Southeast Asia, and Latin America, offering technologies at competitive prices to countries with weaker cybersecurity capabilities.

Furthermore, Chinese espionage efforts have been directed at high-value targets in the U.S., Europe, and other parts of the world. The APT10 hacking group, believed to be associated with the Chinese government, has carried out cyber-espionage campaigns targeting sensitive data from companies and governments globally.

China’s cyber-surveillance operations are also tightly linked with its strategic military goals. The PLA’s Unit 61398 has been identified as a key player in cyber-espionage, particularly in relation to the theft of intellectual property and military technology.

Russia: Cyber Warfare as a Tool of Geopolitical Influence

Governmental Programs and Objectives

Russia’s use of cyber-espionage is deeply intertwined with its geopolitical objectives, and its methods are often considered among the most aggressive in the world. The Federal Security Service (FSB), the Main Intelligence Directorate (GRU), and the Federal Protective Service (FSO) form the core of Russia’s cyber-intelligence apparatus.

The GRU’s Unit 26165, also known as Fancy Bear, has been linked to several high-profile cyber-attacks, including the hacking of the DNC during the 2016 U.S. election. Meanwhile, the FSB focuses on domestic surveillance, utilizing spyware to monitor political opposition, activists, and journalists.

Russia’s cyber strategy is often focused on creating geopolitical instability through cyberattacks that manipulate elections, discredit opponents, and sow discord within rival states. The Kremlin also prioritizes information warfare, blending spyware with disinformation campaigns to achieve its goals.

Key Russian Companies and Technologies

Unlike China and the U.S., Russia’s cyber capabilities are often more directly linked to government agencies, with fewer private corporations playing significant roles. However, a few Russian companies have developed spyware and cyber tools that are widely used in government operations.

• Kaspersky Lab
  • Kaspersky, Russia’s most prominent cybersecurity company, has been accused of having ties to the FSB, though the company denies these claims. Despite being a leading provider of anti-virus software, Kaspersky’s tools have allegedly been leveraged by the Russian government for espionage purposes. Kaspersky has been banned from U.S. federal government systems due to concerns over espionage.
• Positive Technologies
  • Positive Technologies, a Moscow-based cybersecurity firm, has been sanctioned by the U.S. for its role in developing and distributing cyber tools used by Russian intelligence services. The company is linked to the Positive Hack Days conference, where Russian intelligence agencies are believed to recruit hackers.
• Rostelecom
  • Rostelecom is a state-owned telecommunications company that operates a significant portion of Russia’s internet infrastructure. The company has been involved in implementing Russia’s SORM system (System of Operative Investigative Measures), which allows the government to monitor and store all internet communications within the country.
• InfoTeKS
  • InfoTeKS is a major provider of cryptographic protection tools in Russia. It supplies the Russian government with encryption software, while also developing spyware tools for national security purposes. The company is closely aligned with Russia’s military-industrial complex.

Russia’s Role in Global Cyber-Conflicts

Russia’s most infamous cyber tool is X-Agent, a malware used in several high-profile hacks, including the DNC hack in 2016. Developed by the GRU, X-Agent has been deployed against targets in Ukraine, the United States, and Europe. Russia’s cyber activities often serve to destabilize geopolitical rivals, as seen in the NotPetya attack in 2017, which caused widespread disruption in Ukraine and beyond.

Russia’s tactics are not limited to espionage, but include the use of spyware and cyberattacks to sabotage critical infrastructure. The 2015 and 2016 cyber-attacks on Ukraine’s power grid, attributed to Russian actors, demonstrated the capacity of Russia’s cyber arsenal to cause real-world harm and panic.

Russia’s cyber capabilities also extend to leveraging third-party groups and non-state actors, often blurring the lines between government-backed operations and criminal activities. This symbiotic relationship allows the Kremlin to maintain plausible deniability while continuing to engage in cyber espionage and sabotage.

A Global Theatre of Spyware and Cyber-Surveillance

In this landscape of global cyber warfare, the U.S., China, and Russia stand as the foremost actors shaping the spyware and cyber-surveillance industry. Each nation has developed unique capabilities that reflect their geopolitical objectives, technological expertise, and approach to global dominance.

The U.S. leads with technological innovation and partnerships between government agencies and private companies, ensuring a seamless flow of intelligence and data for both surveillance and counterterrorism efforts. China’s focus on internal control and the global expansion of its influence through cyber tools reflects its long-term strategic goals. Meanwhile, Russia’s aggressive use of cyber tools to destabilize geopolitical rivals illustrates the power of espionage and disinformation in modern warfare.

In a world increasingly dependent on digital infrastructure, these nations’ efforts to control and manipulate cyberspace raise critical ethical, legal, and security questions. While spyware may provide valuable national security tools, it also presents significant risks to privacy, freedom, and international stability. As the global cyber-espionage battle intensifies, understanding the players, the technologies, and the stakes has never been more important.

Country	Company Name	Product/Tool	Activities	Capabilities	Operational Area
USA	Palantir Technologies	Gotham, Foundry	Data mining, intelligence gathering, and surveillance	Aggregates and analyzes vast amounts of data for intelligence purposes	Primarily USA, but also global operations
USA	CrowdStrike	Falcon	Threat detection, cybersecurity, and spyware detection	Advanced threat detection, cyber defense, and removal of advanced spyware	Global, with a strong presence in the USA and Europe
USA	Boeing (Argon ST)	Classified Tools	Cyber surveillance and electronic warfare	Signal intelligence (SIGINT), electronic warfare, and countermeasures against adversary communications	US military and intelligence operations
USA	NSO Group	Pegasus (now restricted)	Development and sale of mobile surveillance software	Advanced surveillance and data extraction capabilities from mobile devices	Global, though now restricted by sanctions
USA	Verint Systems Inc.	AudioDisk, RCM, VCM	Digital surveillance and cybersecurity	Audio surveillance, voice monitoring, data collection for law enforcement and intelligence	Global, including USA, Israel, and allied nations
USA	Raytheon Intelligence & Space	Cyber Range	Defense cybersecurity solutions and cyber-espionage tools	Offensive cyber capabilities, critical infrastructure protection, and cyber-intelligence gathering	Primarily US government and NATO operations
China	Huawei Technologies	Surveillance Infrastructure	Development of 5G and telecommunication hardware, suspected espionage	5G network infrastructure, data monitoring, backdoors for potential government surveillance	Global, heavily involved in Africa, Asia, and Europe
China	ZTE Corporation	Telecom surveillance tools	Telecommunications surveillance, providing infrastructure for governments	Network surveillance, encryption, and decryption of communications	Primarily China, expanding into Southeast Asia, Africa
China	Qihoo 360	Vulnerability scanners	Cybersecurity research, spyware development, government hacking campaigns	Exploit discovery, zero-day vulnerabilities research, and advanced threat identification	Domestic China, expanding to international markets
China	Baidu	AI Surveillance Tools	AI-driven surveillance, data mining, and facial recognition for government monitoring	Machine learning, AI-based surveillance systems, massive-scale data analysis	Domestic, with growing influence in Asia and emerging markets
China	Hainan Xiandun Technology	Tools used by APT40	Cyber-espionage activities targeting foreign governments, corporations	Data theft, hacking government and military data, advanced cyber-attacks on critical sectors	Global, primarily targeting USA, Europe, and Asia-Pacific
China	APT10 (linked to Chinese Gov)	Cloud Hopper campaign	Espionage against foreign multinational companies and cloud service providers	Industrial and corporate espionage, IP theft, cyber-espionage through hacking cloud providers	Global, targeting US, Europe, and Asia
Russia	Kaspersky Lab	Kaspersky Anti-virus, Endpoint Security	Suspected of facilitating Russian government cyber activities	Anti-virus software that could provide backdoors to Russian state espionage	Global, including US and European markets
Russia	Positive Technologies	Positive Hack Days	Offensive cybersecurity research and hosting hacking conferences used for recruitment	Develops cyber-attack tools, exploits, and software for offensive cyber operations	Russia, with influence in Asia and Europe
Russia	Rostelecom	SORM (Surveillance System)	Provides the infrastructure for Russian mass surveillance	Enables Russian authorities to monitor, intercept, and store internet communications	Domestic Russia, with export of SORM to allied nations
Russia	GRU (Unit 26165)**	X-Agent, Fancy Bear	Cyber-espionage operations targeting foreign governments and organizations	Advanced persistent threat (APT) group known for sophisticated cyber-espionage, data theft, and hacking campaigns	Global, including Europe, US, and NATO countries
Russia	InfoTeKS	Cryptographic protection, Secure Software	Cryptography and data protection, suspected of building offensive capabilities for Russian government	Data encryption, cryptographic software, and potentially offensive cyber tools	Domestic Russia, with partnerships across Russian allies
Russia	DSIRF (Defunct)**	SubZero	Espionage and surveillance software, used by Russian government entities	Data extraction from devices, spyware development, tracking targets	Russia, with limited global influence
Russia	Group-IB	Threat Intelligence, Zero-day research	Cybersecurity and threat intelligence services, suspected ties to Russian government activities	Threat intelligence, malware research, and developing offensive cyber capabilities	Global, including Europe, Asia, and Russian influence zones

---

Key Highlights:

• United States: The U.S. cyber-espionage ecosystem is heavily influenced by a blend of private-sector tech companies and defense contractors, working closely with governmental intelligence agencies like the NSA, CIA, and DOD. Companies like Palantir, CrowdStrike, and Verint are prominent players that provide cutting-edge spyware and surveillance capabilities for both domestic and international intelligence operations.
• China: China’s spyware industry is intrinsically tied to state interests, with companies like Huawei, ZTE, and Qihoo 360 playing a dual role in providing cybersecurity services and facilitating state surveillance. Chinese government-sponsored groups like APT10 and companies such as Baidu have been heavily involved in cyber-espionage campaigns targeting foreign nations for strategic and industrial secrets.
• Russia: Russia’s cyber-espionage operations are spearheaded by state-backed entities such as the GRU and FSB, which have developed sophisticated hacking tools like X-Agent to target adversaries. Companies such as Kaspersky and Positive Technologies play significant roles in supporting the state’s cyber ambitions. The Kremlin relies on offensive cyber capabilities to destabilize its geopolitical rivals.

---

Appendix 1 – Supplier and Vendor Profiles

Below is a detailed table that contains all the information from the provided dataset:

Entity	Type	Founded	Country	Founders/Key People	Known Products/Services	Notable Clients/Partners	Subsidiaries/Branches	Notable Events/Controversies	Investor Information
Azimuth Security (Trenchant)	Supplier	2010	Australia	Mark Dowd, John McDonald	Exploit development	US government (San Bernardino case)	United Kingdom, Canada, Australia (Operates under “Trenchant”)	Purchased by L3 Technologies (now L3Harris) in 2018. Supposedly restricted sales to Five Eyes intelligence alliance.	L3Harris
Blue Ocean Technologies	Supplier	2015	Israel	Brigadier General Rami Ben Efraim, Lieutenant Colonel Ron Tira	Vulnerability research for cyber tools	Singapore Ministry of Defense	None	Established as part of a deal between founders and an East Asian country (reportedly Singapore).	Rami Ben Efraim (BNF Group)
COSEINC	Supplier	2004	Singapore	Thomas Lim	Vulnerability acquisition, pwn0rama	Unknown	None	Added to US BIS Entity List in 2021 for trafficking in cyber tools used for unauthorized access. Known to host security conference SyScan. Sold SyScan to Qihoo 360. Attempted to sell hacking tools to Hacking Team srl. Company became inactive in 2022.	N/A
Crowdfense	Supplier	2017	UAE	N/A	Zero-day exploit development, vulnerability research	UAE, Saudi Arabia	Abu Dhabi	Launched bug bounty program in 2018 with a $10 million budget. Dissolved in 2023 and reformed under Crowdfense Technological Project Management – Sole Proprietorship LLC in 2024 with a $30 million budget.	Unknown, possibly state-funded
Dataflow Security s.r.l.	Supplier	2022	Italy	Ofer Cohen	Vulnerability research, exploit development	N/A	Spain, sister company Dataflow Forensics (defensive cybersecurity)	Established Dataflow Security Spain SL and Dataflow Forensics in 2022. Acquired a majority stake in Random Research (Israel). Share capital increased from €3,000 to €153,000 in June 2024, indicating new investment.	N/A
PARS Defense	Supplier	2021	Turkey	Ibraham Baliç	Vulnerability research for mobile systems, iOS exploit detection	N/A	None	Attributed to iOS vulnerabilities by Google. No known challenges to operations.	N/A
Protect Electronic Systems LLC	Supplier	2016	UAE	N/A	Exploit development, spyware infrastructure	Unknown	None	Built on Variston IT’s spyware infrastructure. Reportedly emerged from DarkMatter’s zero-day exploit team.	Possibly state-funded
RebSec Solutions	Supplier	2012	India	Vishvadeep Singh	Unknown	N/A	None	Limited open-source reporting.	N/A
Zerodium LLC	Supplier	2015	USA	Chaouki Bekrar	Zero-day exploit vendor	US National Security Agency (NSA)	None	Founded after Vupen dissolved in 2015. One of the first firms to advertise exploit specifications with corresponding prices.	N/A
Aglaya Scientific Aerospace	Vendor	2014	India	Ankur Srivastava	Spyware services, disinformation, censorship-as-a-service	Non-government entities	None	Offers to run spyware operations for clients. Holding companies became inactive in 2021.	N/A
Cognyte Software Ltd.	Vendor	2020	Israel	Elad Sharon	Security analytics software	US Department of Defense, Meta, Norwegian Government Pension Fund Global	India, Brazil, Bulgaria, Canada, USA, Mexico, UK, Taiwan, Thailand, Germany, Cyprus, Netherlands, Romania	Previously part of Verint Systems Inc. Shares traded on NASDAQ. History includes backdoors in surveillance products (AudioDisk) and controversial use of social media platforms for data collection. Norwegian Government Pension Fund divested due to human rights abuses risk.	Visa Equity Partners
CyberRoot Risk Advisory	Vendor	2013	India	Vijay Singh Bisht, Chiranshu Ahuja, Vibhor Sharma	Spyware and risk advisory services	Appin Security Group, BellTroX	UK (CyberRoot Limited)	Entered into “information sharing” relationship with Appin Security Group and BellTroX. No further details on this relationship.	N/A
DataForense s.r.l.	Vendor	2013	Italy	Annunziata Cirilloin	Aretmide/Spyrtacus spyware	N/A	None	Specialized in extracting data from Android and iOS. Company in liquidation as of 2024.	N/A
DSIRF GmbH	Vendor	2016	Austria	Stefan Gesselbauer	SubZero spyware	N/A	Subsidiary: MLS Machine Learning Solutions GmbH (Austria)	Entered liquidation proceedings in 2023. MLS Machine Learning Solutions likely absorbing business.	DSR Decision Supporting Information Forensic
Gamma Group International	Vendor	2008	Germany	N/A	FinSpy spyware	Singapore, South Africa, Turkey	UK, British Virgin Islands, Cyprus	Involved in the sale of FinSpy spyware to various governments. Shut down operations in Germany in 2022 after legal prosecution. Financial structure remains operational in UK and offshore locations.	Private family ownership
InvaSys a.s.	Vendor	2017	Czechia	Kyrre Sletsjøe	Mobile phone interception, backdoor access to Android and iPhone	N/A	Brno, Prague	No challenges to operations. Also runs Defense System Property Protection and YX Systems. Owns 91% of InvaSys.	N/A
Leo Impact Security Services	Vendor	2009	India	Manish Kumar	Spyware services	N/A	Czechia	Known to be a competitor of Aglaya.	N/A
Mollitiam Industries	Vendor	2018	Spain	Santiago Molins Riera	Invisible Man, Night Crawler spyware	Spain’s National Intelligence Centre (CNI), Mando Conjunto de Ciberdefensa (MCCD)	In-Nova, StackOverflow Ltd.	Received financial support from EU’s Regional Development Fund. Known for tools that intercept communications and steal cloud data from infected devices. Venture capital investors include EASO Ventures, Sabadell Venture Capital, and Torsa Capital.	EU Development Fund, EASO Ventures, Sabadell Venture Capital, Torsa Capital
Movia S.p.A.	Vendor	2003	Italy	Luca Spina	Spider spyware	Italian prosecution offices	Bioss (subsidiary)	Known to sponsor ISS World (global surveillance trade show). Investor: Sistema Investimenti. Exposed by Direzione Nazionale Antimafia e Antiterrorismo.	Sistema Investimenti
Negg Group s.r.l.	Vendor	2013	Italy	Francesco Taccone	Skygofree spyware	N/A	Reggio Calabria, Rome	Skygofree spyware can force devices to connect to attacker-controlled WiFi networks, exploit encrypted WhatsApp messages. Meta removed negg Group’s Facebook and Instagram accounts in 2024.	N/A
Positive Technologies AO	Vendor	2002	Russia	Yuri Maksimov, Dmitry Maximo	Exploit development, cybersecurity tools	Lukoil, Vimpelcom, Sberbank, Hanwha, Samsung, Societe Generale, ANSSI	Six countries (international presence)	Added to US OFAC sanctions list in 2021. Also listed by US Department of State for trafficking in cyber tools. Accused of distributing exploits for malicious cyber activities.	N/A
RCS Labs (RCS ETM Sicurezza)	Vendor	1992	Italy	N/A	Hermit spyware	Bangladesh, Pakistan, Turkmenistan	Seven subsidiaries (Aurora Group, Cy4Gate)	Facilitated the sale of Hacking Team’s RCS spyware. Acquired by Cy4Gate in 2022.	Cy4Gate, Elettronica Group, Expert System
Variston IT	Vendor	2018	Spain	Ralf Wegener, Ramanan Jayaraman	Heliconia spyware	N/A	None	Acquired Truel IT in 2018 (Italian zero-day research company). Reported as defunct in 2024.	N/A

This table includes all the suppliers and vendors, their details, and relevant information such as subsidiaries, investors, and notable events.

---

Appendix 2 – Markets Map: Vendor List

Below is a detailed table continuing the vendor list with relevant data, showing company details, known subsidiaries, and other critical elements associated with each vendor.

Vendor	Subsidiaries/Branches	Key Founders/People	Known Products/Services	Notable Clients/Partners	Notable Events/Controversies
Aglaya Scientific Aerospace Technology Systems Private Limited	N/A	Ankur Srivastava	Spyware, zero-day exploits, disinformation campaigns	Non-government entities	Focuses on spyware operations and disinformation campaigns. Inactive holding companies in 2021.
Appin Security Group	Approachinfinate Computer and Security Consultancy Grp., Adaptive Control Security Global Corporate	Rajat Khare	Cyber-espionage, spyware, hacking services	Various clients (non-disclosed)	Allegedly involved in cyber-espionage and “hack-for-hire” services. Linked to BellTroX Infotech.
BellTroX Infotech Services Private Ltd	N/A	Sumit Gupta	Hack-for-hire services, cyber-espionage tools	Unknown	Reportedly offers “hack-for-hire” services targeting individuals and institutions worldwide.
Candiru Ltd.	DF Associates, Grindavik Solutions Ltd./Greenwick Solutions, Taveta Ltd./Tabatha Ltd, Saito Tech Ltd.	Ya’acov Weitzman, Eran Shorer	Spyware development, cyber-surveillance tools	Governments of Hungary, Spain, UAE	Name changed multiple times to avoid negative press. Added to US Entity List in 2021.
CyberRoot Risk Advisory Private Limited	CyberRoot Software Solutions LTD (UK)	Vijay Singh Bisht, Chiranshu Ahuja, Vibhor Sharma	Risk advisory services, spyware	Appin Security Group, BellTroX	Linked to Appin and BellTroX. Holds a UK-based subsidiary.
Cytrox AD	N/A	Rotem Farkash, Abraham Rubinstein	Predator spyware	Various governments	Part of Intellexa Consortium, linked to spyware abuse.
Intellexa S.A.	Intellexa Consortium	Tal Dilian	Predator spyware, cyber-surveillance tools	Various governments	Involved in spyware abuse; part of Intellexa Group. Sanctioned by US in 2023.
Dataflow Security s.r.l.	Dataflow Security Spain SL, Dataflow Forensics	Ofer Cohen	Vulnerability research, exploit development	Unknown	Expanded to Spain in 2022. Acquired a stake in Random Research (Israel).
DataForense s.r.l.	N/A	Annunziata Cirilloin	Aretmide/Spyrtacus spyware	Unknown	In liquidation as of 2024. Specialized in mobile spyware.
DSIRF GmbH	MLS Machine Learning Solutions GmbH	Stefan Gesselbauer	SubZero spyware	N/A	Entered liquidation proceedings in 2023.
Equus Technologies	MerlinX Ltd.	Matan Markovics, Daniel Hanga, Tal Tchwella	Lipizzan spyware	Various governments	Changed name to MerlinX after losing business due to negative press. Acquired by Bindecy in 2021.
Gamma Group International SAL	Gamma International GmbH, FinFisher Labs GmbH	Unknown	FinSpy spyware	Various governments (Singapore, South Africa, Turkey)	Shut down operations in Germany after legal prosecution in 2022, financial structure remains operational offshore.
Hacking Team srl (Italy)	Memento Labs srl	David Vincenzetti, Valeriano Bedeschi	Remote Control Systems (RCS) spyware	Various governments (Ecuador, Nigeria, Saudi Arabia)	Changed name to Memento Labs after a 2015 data leak.
Hacking Team srl (United States)	N/A	David Vincenzetti, Valeriano Bedeschi	Spyware development	US law enforcement	US branch focused on government and law enforcement contracts.
Grey Heron (United Kingdom)	N/A	Hacking Team srl executives	Potential spin-off of Hacking Team	Unknown	Spin-off announced in 2017 but limited data available.
Grey Heron (Italy)	N/A	Hacking Team srl executives	Potential spin-off of Hacking Team	Unknown	Spin-off announced in 2017 but limited data available.
Interionet Systems Ltd.	N/A	Yair Pecht, Sharon Oknin	Router malware, IoT device exploitation	Belgian Police	Former NSO Group employees founded this company; involved in Belgian Police modernization project.
InvaSys a.s.	N/A	Kyrre Sletsjøe	Mobile phone interception, spyware	N/A	Kelpie spyware program. Not facing operational challenges in the Czech Republic.
Leo Impact Security Service PVT Ltd.	Leo Impact Security s.r.o. (Czechia)	Manish Kumar	Spyware services	N/A	Competitor of Aglaya in the Indian market.
Mollitiam Industries	N/A	Santiago Molins Riera	Invisible Man, Night Crawler spyware	Spanish Intelligence Agencies	Financial support from the EU’s Regional Development Fund. Known for sophisticated spyware tools.
Movia SPA	Bioss	Luca Spina	Spider spyware	Italian prosecution offices	Sponsor of ISS World. Exposed by Italian anti-mafia investigative directorate.
Negg Group S.R.L	N/A	Francesco Taccone	Skygofree spyware	Unknown	Exploits WhatsApp vulnerabilities and attacker-controlled WiFi networks. Removed from Facebook and Instagram by Meta.
Negg International	N/A	Francesco Taccone	Spyware tools	Unknown	Operated briefly in the Netherlands.
NSO Group	L.E.G.D Technologies, Q Cyber Technologies, Westbridge Technologies, Osy Technologies SARL, Q Cyber Technologies SARL	Shalev Hulio, Omri Lavie, Niv Karmi	Pegasus spyware	Various governments	Widely known for Pegasus spyware. Sanctioned by the US and added to the Entity List in 2021.
Paragon Solutions	Paragon Solutions US	Ehud Schneorson, Idan Nurick, Igor Bogudlov, Liad Avraham	Spyware development	US government	Aiming to break into the US market.
Positive Technologies AO (Russia)	Positive Technologies Global Holding Ltd. (UK), Positive Technologies Global Solutions Ltd. (UK), Positive Technologies S.R.L (Italy, Romania), Positive Technologies Inc. (US), Positive Technologies Czech s.r.o. (Czechia), Positive Technologies Holding AG (Switzerland)	Yuri Maksimov, Dmitry Maximo	Vulnerability research, exploit development	Various clients, including Russian government	Added to the US sanctions list in 2021 for cyber espionage and malicious activities.
Quadream Inc.	N/A	Guy Geva, Nimrod Reznik, Ilan Dabelstein	Reign spyware	N/A	Founded by ex-NSO Group employees.
RCS ETM Sicurezza S.p.A.	RCS MEA DMCC	N/A	Hermit spyware	Various governments (Bangladesh, Pakistan, Turkmenistan)	Part of Aurora Group, acquired by Cy4Gate in 2022.
Variston IT	Truel IT	Ralf Wegener, Ramanan Jayaraman	Heliconia spyware, SCADA, IoT exploitation tools	N/A	Acquired Truel IT in 2018. Effectively defunct as of 2024.
Verint Systems Inc.	Verint Systems Ltd., Cognyte Software Ltd. (Israel)	Elad Sharon (CEO of Cognyte)	Security analytics, surveillance tools	US Department of Defense, governments worldwide	Cognyte Software Ltd. spun off from Verint. Various controversies surrounding social media manipulation.

---

APPENDIX 3 – Entity changes – 2023

• Gamma T S E Limited changed its name to Global T S E Limited. This is its second name change.
• Nexa Technologies changed its name to RB 42. This is its first name change.
• Own BackUp changed its name to Own Company (Israel). This is its first name change.
• Aurora S.p.A. changed its name to RCS Group. This is its first name change.
• Dufresne Holdings was founded.
• Blumberg Capital formed association.
• Red Dot Capital formed association.
• NGN International formed association.
• ABS MENA formed association.
• Digiqore formed association.
• Own Company (United States) formed association.
• I.B.I. Trust Management formed association.
• OwnBackUp UK Limited formed association.
• OwnBackUp UK Limited formed association.
• OwnBackup GmbH formed association.
• OwnBackUp (Australia) formed association.
• David Brenner formed association.
• Rosen Avraham Ze’ev formed association.
• David Brenner Ltd. formed association.
• Lee and Rami Ben-Ephraim Ltd. formed association.
• Tira Enterprises Ltd. formed association.
• BIOSS was founded.
• Paolo Stagno formed association.
• Random Research was founded.
• John Aakerblom formed association.
• Andrea Todesco formed association.
• Federica Marin formed association.
• Paolo Ronco formed association.
• Jonathan Shuman formed association.
• Banca del Mezzogiorno MedioCredito Centrale S.p.A. formed association.
• MLS Machine Learning Solutions (Spain) was founded.
• Stefan Gesselbauer formed association.
• NSO Group was closed.
• Dream Security ended association.
• Dufresne Holdings was closed.
• Saito Tech Ltd. was closed.
• Sokoto Ltd was closed.
• Qatar Investment Authority ended association.
• Optas Industry Ltd. ESOP ended association.
• Optas Industry Ltd ended association.
• Ibn Hemdat Trusts 1992 Ltd ended association.
• IBI Trust Management ended association.
• Founders Group ended association.
• ESOP management and trust services ended association.
• Memento Labs Srl was closed.
• VASTech was closed.
• InTheCyber (Switzerland) ended association.
• InTheCyber (Italy) ended association.
• BellTroX Infotech Services Private Ltd was closed.
• Global T S E Limited was closed.
• GTSC LTD was closed.
• Mindstone International LTD was closed.
• RB 42 ended association.
• Passitora Ltd ended association.
• Advanced Middle East Systems ended association.
• Setco Technology Solutions Ltd ended association.
• Cytrox AD was closed.
• Senpai Technologies Ltd ended association.
• Trovicor fz/Trovicor Intelligence ended association.
• Intellexa S.A. was closed.
• Peterbald Ltd was closed.
• Cytrox Holdings Zrt was closed.
• Balinese Ltd was closed.
• Aliada Group Inc. ended association.
• Miros Development Group ended association.
• Thalestris Limited ended association.
• Quadream Inc was closed.
• Niv Karmi ended association.
• Omri Lavie ended association.
• Shalev Hulio ended association.
• Eddy Shalev ended association.
• Shiri Dolev ended association.
• Gilad Sahar ended association.
• Niv Magen ended association.
• Tom Gol ended association.
• Yaron Shohat ended association.
• Stefan Kowskin ended association.
• Bastian Lueken ended association.
• Stephen Peel ended association.
• Interionet Systems Ltd was closed.
• Yair Pecht ended association.
• Sharon Oknin ended association.
• Joshua Lesher ended association.
• David Fischler ended association.
• Net Capital Ventures ended association.
• NME Investments Limited ended association.
• Mikael Ltd. ended association.
• Altshuler Shaham Trusts Ltd. ended association.
• Ya’acov Weitzman ended association.
• Eran Shorer ended association.
• Erdinast Giora ended association.
• Karen Jean Seymour ended association.
• William Louthean Nelson ended association.
• John Hadjicostas ended association.
• Tal Dilian ended association.
• Georgios Georgioy ended association.
• Rotem Farkash ended association.
• Abraham Rubinstein ended association.
• Sara Hamou ended association.
• Intellexa Ltd (British Virgin Islands) was closed.
• David Vincenzetti ended association.
• Valeriano Bedeschi ended association.
• Abdullah Al-Qahtani ended association.
• Khalid Al-Thebity ended association.
• Paulo Lezzi ended association.
• Serpikom SAS ended association.
• VASTech AG ended association.
• Frans Dreyer ended association.
• Peter Habertheuer ended association.
• Divian Emmanuel Dreyer ended association.
• Guy Geva ended association.
• Nimrod Reznik ended association.
• Ilan Dabelstein ended association.
• Nenad Grozdanic ended association.
• Christos Shiakallis ended association.
• Doron Breiter ended association.
• Ori Ashkenazi ended association.
• Roy Glasberg Keller ended association.
• Paragon Solutions was closed.
• Paragon Solutions US was closed.
• Ehud Schneorson ended association.
• Idan Nurick ended association.
• Igor Bogudlov ended association.
• Liad Avraham ended association.
• Battery Ventures (Israel) ended association.
• Battery Ventures (United Kingdom) ended association.
• Battery Ventures (United States) ended association.
• Blumberg Capital ended association.
• Red Dot Capital ended association.
• Aaron Rinberg ended association.
• Cognyte Software Ltd. (Israel) was closed.
• Cognyte Analytics India Private Limited was closed.
• Cognyte Brasil S.A. was closed.
• Cognyte Bulgaria EOOD was closed.
• Cognyte Canada Inc. was closed.
• Cognyte Software LP was closed.
• Cognyte Software México, S.A. de C.V. was closed.
• Cognyte Software UK Limited was closed.
• Cognyte Solutions Ltd. was closed.
• Cognyte Systems Ltd. was closed.
• Cognyte Taiwan Ltd. was closed.
• Cognyte Technologies Israel Ltd. was closed.
• Cognyte Technology Inc. was closed.
• Focal Info Israel Ltd. (In dissolution) was closed.
• Gita Technologies Ltd. was closed.
• Syborg GmbH was closed.
• Syborg Grundbesitz GmbH was closed.
• Syborg Informationsysteme b.h. OHG was closed.
• Cognyte Netherlands B.V. was closed.
• Cognyte Romania S.R.L. was closed.
• Daniel (Dan) Bodner ended association.
• Udi Levy ended association.
• Shay Attias ended association.
• Yuval Altman ended association.
• Jason Wright ended association.
• Elad Sharon ended association.
• David Abadi ended association.
• Gil Cohen ended association.
• Charles Burdick ended association.
• Earl Shanks ended association.
• Richard Nottenburg ended association.
• Dafna Sharir ended association.
• Zvika Naggan ended association.
• Karmit Shilo ended association.
• Sharon Chouli ended association.
• Ziv Levi ended association.
• Rini Karlin ended association.
• Avi Schechter ended association.
• Amit Daniel ended association.
• Miki Migdal ended association.
• John Alexander Louthean Nelson ended association.
• Pauline Louise Nelson ended association.
• CyberRoot Software Solutions LTD was closed.
• CyberRoot Group was closed.
• Cyber Root Limited was closed.
• Vijay Singh Bisht ended association.
• Ankit Kumar Sharma ended association.
• Anita ended association.
• Chiranshu Ahuja ended association.
• Vibhor Sharma ended association.
• Nitin Kumar Agarwal ended association.
• Variston IT was closed.
• Ralf Wegener ended association.
• Ramanan Jayaraman ended association.
• Mollitiam Industries was closed.
• Samuel Álvarez González ended association.
• Antonio Ramos Varon ended association.
• Sabadell Venture Capital ended association.
• EASO Ventures ended association.
• Centre for the Development of Industrial Technology (CDTI) ended association.
• Positive Technologies AO (Russia) was closed.
• NGN International ended association.
• ABS MENA ended association.
• Digiqore ended association.
• Yuriy Vladimirovich Maksimov ended association.
• Denis Sergeyevich Baranov ended association.
• Dmitriy Vladimirovich Maksimov ended association.
• Positive Group PJSC was closed.
• Yevgeniy Vyacheslavovich Kireyev ended association.
• Sumit Gupta ended association.
• Inder Mohan Jain ended association.
• Mani Kant Jain ended association.
• Ritu Jain ended association.
• Leo Impact Security s.r.o. was closed.
• Manish Kumar ended association.
• Sunita Devi ended association.
• MerlinX Ltd was closed.
• Own Company (Israel) ended association.
• Own Company (United States) ended association.
• Matan Markovics ended association.
• Daniel Hanga ended association.
• I.B.I. Trust Management ended association.
• OwnBackUp UK Limited ended association.
• OwnBackUp UK Limited ended association.
• OwnBackup GmbH ended association.
• OwnBackUp (Australia) ended association.
• Rebsec Solutions was closed.
• Vishvadeep Singh ended association.
• RCS ETM Sicurezza S.p.A. was closed.
• RCS MEA DMCC was closed.
• Vytautas Celiesius ended association.
• Marco Latini ended association.
• RCS Group ended association.
• Cy4Gate ended association.
• BlueOcean Technologies Ltd was closed.
• Emanuele Galtieri ended association.
• Domitilla Benigni ended association.
• Roberto Ferraresi ended association.
• Rami Ben Efraim ended association.
• Col. Ron Tira ended association.
• Avi Rosen ended association.
• Island Giora ended association.
• David Brenner ended association.
• Rosen Avraham Ze’ev ended association.
• David Brenner Ltd. ended association.
• Lee and Rami Ben-Ephraim Ltd. ended association.
• Tira Enterprises Ltd. ended association.
• Movia SPA was closed.
• BIOSS was closed.
• Luca Spina ended association.
• InvaSys a.s. was closed.
• Kyrre Sletsjøe ended association.
• Martina Sletsjøe ended association.
• Operation Zero was closed.
• Sergei Zelenyuk ended association.
• Anonymous ended association.
• Zerodium LLC was closed.
• Chaouki Bekrar ended association.
• Isabelle Gorius ended association.
• Negg Group S.R.L was closed.
• Francesco Taccone ended association.
• Paolo Frascati ended association.
• Protect Electronic Systems LLC was closed.
• Awad Al Shamsi ended association.
• Mansour Al Mulla ended association.
• Hamad Al Marar ended association.
• Crowdfense Limited was closed.
• Andrea Zapparoli Manzoni ended association.
• Paolo Stagno ended association.
• Trenchant Group (Australia) was closed.
• Trenchant Group (United States) was closed.
• Trenchant Group (United Kingdom) was closed.
• L3Harris Trenchant LTD was closed.
• L3Harris Trenchant Canada Inc. was closed.
• L3Harris Azimuth Security PTY was closed.
• L3Harris Technologies ended association.
• PARS Defense was closed.
• Ibrahim Baliç ended association.
• DataForense s.r.l was closed.
• Annunziata Cirillo ended association.
• Dataflow Security s.r.l. was closed.
• Dataflow Forensics was closed.
• Dataflow Security Spain SL ended association.
• Random Research was closed.
• Ofer Cohen ended association.
• Jonathan Levin ended association.
• John Aakerblom ended association.
• Andrea Todesco ended association.
• Federica Marin ended association.
• Paolo Ronco ended association.
• Jonathan Shuman ended association.
• Banca del Mezzogiorno MedioCredito Centrale S.p.A. ended association.
• DSIRF GmbH was closed.
• MLS Machine Learning Solutions (Austria) was closed.
• MLS Machine Learning Solutions (Spain) was closed.
• Stefan Gesselbauer ended association.
• DSIRF Decision Supporting Information Research and Forensic Ltd was closed.
• DSR Decision Supporting Information Research Forensic GmBh ended association.
• Aleksey Vyacheslavovich Andreyev ended association.
• Boris Borisovich Simis ended association.
• Andrey Kuzin ended association.
• Positive Technologies Global Solutions Ltd (United Kingdom) was closed.
• Positive Technologies Holding AG (Switzerland) was closed.
• Positive Technologies S.R.L (Romania) was closed.

---

source :

• Open source data
• Azimuth Security (Trenchant)
• Blue Ocean Technologies
  • Founding by Rami Ben Efraim and Ron Tira: The Globes (Israeli newspaper) and Intelligence Online.
  • Deal with Singapore’s Ministry of Defense: Intelligence Online.
• COSEINC
  • Founder Thomas Lim and relationship with Hacking Team: WikiLeaks archive and The Verge.
  • Inclusion in BIS Entity List: US Department of Commerce and Bureau of Industry and Security (BIS) announcements.
  • Sale of SyScan to Qihoo 360: WikiLeaks and The Register.
• https://dfrlab.org/
• Crowdfense
  • Creation and operations, bug bounty programs: Wired and Reuters reports on Crowdfense’s bug bounty budgets and program expansions.
  • UAE and Saudi Arabia involvement: The Guardian and Financial Times.
• Dataflow Security s.r.l.
  • Founding by Ofer Cohen and corporate expansion: Italian corporate registry, Official Spanish Corporate Gazette for Dataflow Spain.
  • Majority stake in Random Research: Corporate filings in Israel and Italy.
• PARS Defense
  • Founded by Ibraham Baliç: Forbes articles on Baliç’s vulnerability work.
  • iOS vulnerability findings: Google Project Zero reports and Google’s public security research blog.
• Protect Electronic Systems LLC
  • Founded after DarkMatter’s zero-day exploit team dissolved: Reuters, Wired, and The New York Times reports on DarkMatter’s team.
  • Partnership with Variston IT: Intelligence Online.
• RebSec Solutions
  • Founded by Vishvadeep Singh: Public business directories and India’s Ministry of Corporate Affairs.
• Zerodium LLC
  • Founded by Chaouki Bekrar: Motherboard (VICE) coverage on Zerodium’s launch and public marketing strategies.
  • Role of Vista Incorporations Ltd. in Delaware: Delaware Business Directory.
• Aglaya Scientific Aerospace Technology Systems Private Limited
  • Spyware operations and disinformation campaigns: The Hindustan Times and The Guardian.
• Appin Security Group
  • Cyber-espionage allegations: The Wall Street Journal and Times of India reports on Appin’s role in global hacking scandals.
  • Link to BellTroX: Reuters and Citizen Lab investigations.
• BellTroX Infotech Services Private Ltd
  • Hack-for-hire services: Reuters and Citizen Lab reports on the company’s hack-for-hire network.
• Candiru Ltd.
  • Multiple name changes and involvement in spyware: The Washington Post, Reuters, and US Entity List (2021).
  • Ownership information: Corporate filings in Israel and Bureau of Industry and Security data.
• CyberRoot Risk Advisory Private Limited
  • Link with Appin Security Group and BellTroX: Citizen Lab reports and Reuters investigations.
• Cytrox AD
  • Predator spyware and part of Intellexa Group: Citizen Lab and Financial Times coverage on Intellexa.
• Intellexa S.A.
  • Intellexa Consortium and spyware proliferation: Forbes, The Guardian, and Reuters reports on the Intellexa Consortium’s operations.
• DataForense s.r.l.
  • Aretmide/Spyrtacus spyware: Italian corporate registry and Intelligence Online.
• DSIRF GmbH
  • SubZero spyware: Bloomberg and Der Spiegel reports on DSIRF’s spyware activities.
• Equus Technologies
  • Transition to MerlinX and the Lipizzan spyware: Google Project Zero blog and Forbes.
  • Acquisition by Bindecy: Reuters.
• Gamma Group International
  • FinFisher spyware: The Guardian, Wired, and Citizen Lab investigations.
  • Shutdown in Germany: BBC and German court records.
• Hacking Team srl
  • Data leak and transition to Memento Labs: Wired, Motherboard, and WikiLeaks documents on the 2015 leak.
  • Corporate filings in Italy for Memento Labs.
• Interionet Systems Ltd.
  • Founded by former NSO Group employees: Forbes and Reuters.
  • Contract with Belgian police: Intelligence Online.
• InvaSys a.s.
  • Spyware tools and operations: Czech Business Directory and Intelligence Online.
• Leo Impact Security Service PVT Ltd.
  • Competition with Aglaya: The Times of India.
• Mollitiam Industries
  • Invisible Man and Night Crawler spyware: The Guardian and Spanish government records.
  • Financial support from EU Regional Development Fund: European Union Official Journal.
• Movia SPA
  • Sponsorship of ISS World and relationship with Italian authorities: La Repubblica and Italian investigative records.
  • Exposure by Direzione Nazionale Antimafia e Antiterrorismo: La Stampa.
• Negg Group S.R.L
  • Skygofree spyware: Kaspersky Lab report and Meta investigations.
• NSO Group
  • Pegasus spyware, involvement in human rights violations: The New York Times, Washington Post, Citizen Lab reports.
  • Sanction by US government: Bureau of Industry and Security (BIS), US Department of Commerce.
• Paragon Solutions
  • Entry into US market: The Guardian and Reuters reports.
• Positive Technologies AO
  • Sanctions by US: US Department of State and Office of Foreign Assets Control (OFAC) listings.
  • Client information: Intelligence Online and corporate websites.
• Quadream Inc.
  • Reign spyware, founded by ex-NSO employees: Citizen Lab and The Times of Israel.
• RCS ETM Sicurezza S.p.A.
  • Hermit spyware and acquisition by Cy4Gate: Lookout security researchers and Cy4Gate financial reports.
• Variston IT
  • Acquisition of Truel IT and Heliconia spyware: Google Project Zero reports, Intelligence Online.
• Verint Systems Inc.
  • History and corporate restructuring leading to Cognyte: The Guardian, Reuters, and Bloomberg coverage of corporate developments.
• Each of these sources is rooted in public corporate data, investigative journalism, cybersecurity research reports, and governmental documents, such as sanctions lists and court filings.

---

Copyright of debuglies.com
Even partial reproduction of the contents is not permitted without prior authorization – Reproduction reserved