SpyLedger dossier · Mercenary spyware

Intellexa / Cytrox

Intellexa is a "consortium" / loosely affiliated international web of companies that develops and markets the Predator commercial spyware, founded by former-intelligence figure Tal Jonathan Dilian. U.S. authorities have named related corporate entities across multiple jurisdictions, including Intellexa S.A. (Greece), Intellexa Limited (Ireland), Cytrox Holdings ZRT/Crt (Hungary), Cytrox AD (North Macedonia), Thalestris Limited (Ireland), and Aliada Group Inc. (British Virgin Islands). On 2025-12-30, OFAC removed three individuals from the SDN List following petitions for reconsideration: Sara Aleksandra Fayssal Hamou (designated 2024-03-05), and Andrea Nicola Costantino Hermes Gambazzi and Merom Harpaz (both designated 2024-09-16); Treasury stated each had demonstrated measures to separate from the Intellexa Consortium. No corporate entities were delisted: the BIS Entity List entries and the OFAC entity designations from 2024 remain in place per public record as of the research date.

Headquarters: Greece

Products

Predator (mercenary spyware suite; one-click and zero-click mobile device compromise)
Nova (successor/rebranded Predator implant reported by security researchers)

Government designation status

3 active designations from the surveyed authorities. Each is a public government record with a different legal effect — read the type label and scope on each.

US BISExport controlEntity List · 2023-07-18

A license is required to export US-origin items/technology to the entity, typically reviewed under a presumption of denial (e.g. BIS Entity List). It is not an asset freeze.

Bureau of Industry and Security added four affiliated entities to the Entity List for 'trafficking in cyber exploits used to gain access to information systems': Intellexa S.A. (Greece), Cytrox Holdings Crt (Hungary), Intellexa Limited (Ireland), and Cytrox AD (North Macedonia). Effect is an export-control restriction: a license requirement (reviewed under a presumption of denial) for all items subject to the EAR. This is NOT an asset-freezing sanction. Confirmed against the BIS primary press release. All four entity entries remain on the Entity List as of the research date.

Commerce Adds Four Entities to the Entity List for Trafficking in Cyber Exploits (BIS, July 18, 2023)

US OFACSanction (asset-blocking)SDN List (E.O. 13694, as amended) · 2024-03-05

Property within US jurisdiction is blocked and US persons are generally prohibited from dealings (e.g. OFAC SDN List).

OFAC designated two individuals (Tal Jonathan Dilian, founder/architect; Sara Aleksandra Fayssal Hamou) and five entities (Intellexa S.A., Intellexa Limited, Cytrox AD, Cytrox Holdings ZRT, Thalestris Limited) pursuant to E.O. 13694, as amended by E.O. 13757 (malicious cyber-enabled activities). Effect: blocking sanction — all property and interests in property within US jurisdiction are blocked and US persons are generally prohibited from dealing with them. CORRECTION ON CURRENT STATUS: Hamou was removed from the SDN List on 2025-12-30 (see OFAC recent action 20251230); Dilian and all five entities remain designated as of the research date. Names, authority, date, and blocking language confirmed against Treasury press release jy2155.

Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium (March 5, 2024; corroborated by OFAC Recent Actions 2024-03-05 and 2025-12-30 removal)

US OFACSanction (asset-blocking)SDN List (E.O. 13694, as amended) · 2024-09-16

Property within US jurisdiction is blocked and US persons are generally prohibited from dealings (e.g. OFAC SDN List).

OFAC designated five individuals (Felix Bitzios, Andrea Nicola Costantino Hermes Gambazzi, Merom Harpaz, Panagiota Karaoli, Artemis Artemiou) and one entity (Aliada Group Inc., a British Virgin Islands company) associated with the Intellexa Consortium pursuant to E.O. 13694, as amended. Effect: blocking sanction — assets within US jurisdiction blocked; US persons generally prohibited from transactions. CORRECTION ON CURRENT STATUS: per the OFAC primary record, Gambazzi and Harpaz were removed from the SDN List on 2025-12-30 (recent action 20251230); Bitzios, Karaoli, Artemiou, and Aliada Group Inc. remain designated as of the research date. Names, authority, date, and blocking language confirmed against Treasury press release jy2581.

Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium (Sept 16, 2024; 2025-12-30 removals confirmed at OFAC Recent Actions 20251230)

This dossier restates public government-designation records; it is not an allegation of wrongdoing by AI Analytics, and it publishes no customer-deployment claims or targeting data. A designation describes a specific legal action by a named authority — read its scope; an export control, an equipment-authorization restriction, and an asset-blocking sanction are not the same thing. To dispute or correct an entry, contact us (see the methodology). Status current as of the 2026-06-23 build — confirm against the linked primary source. Back to all vendors.