I is for Intellexa — The Alliance, or Spyware Structured to Survive

The Alphabet of Actors — Letter I. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED.

FinFisher, six letters ago, died. It sold the endpoint implant — the spyware that lives on a target's phone and reads the plaintext before the encryption can seal it — and when the exposure and the criminal investigation came, the company went insolvent and ceased to exist. Its verdict was DISSOLVED, and INHERITED: the firm ended, and the modality it pioneered was inherited whole by its successors. This is the letter about the inheritor, and about the single most important lesson the surveillance industry learned from watching the first generation get caught: do not be a company in a country. Be an alliance across many.

Intellexa is not, strictly, a company. Google's own report on the commercial-surveillance-vendor industry calls it 'an alliance of capabilities' — a web of separate firms, in separate jurisdictions, that together produce and sell a single class of product, the mercenary spyware called Predator. One entity builds the implant; another handles delivery; another the sales; and they are spread, deliberately, across Cyprus and Greece and Ireland and North Macedonia and Israel and Hungary, so that no single government's export law, and no single country's prosecutor, ever holds the whole thing in its hand. Where FinFisher was a target you could reach, Intellexa is a structure you cannot — and the structure is the point of the letter.

Because Intellexa's most important innovation is not its spyware, which is merely as good as its competitors'. It is its shape. This is the letter about corporate architecture as an accountability shield, about the euphemism-gap coming home to a democracy, and about the newest tool that has been tried against the spyware industry — sanctions — colliding with a company built specifically to survive them.

1. The Actor: an alliance, by design

Read the description of Intellexa and the first thing to notice is that it resists being described as one thing. Google's Buying Spying report puts it plainly: 'The Intellexa Alliance, originally based in Cyprus, but now based in Greece, is a prominent example of collaboration among different actors' in the commercial-surveillance-vendor industry. It names the parts — Cytrox, which builds the Predator spyware; WiSpear; Circles Technologies — and the figure associated with assembling them, a founder named Tal Dilian, described in the European Parliament's own reporting as an ex-intelligence officer 'building a new empire.' Intellexa is the brand painted over that assemblage. The actor is the alliance.

This matters because it is the deliberate answer to a problem the industry watched its predecessors fail to solve. A vendor that is a single company in a single country has a single point of failure: that country's export-control regime can deny it a licence, and that country's prosecutors can raid it. FinFisher, headquartered in Germany, was reached by exactly those two levers — a German export-law complaint and a Munich investigation — and it died. Amesys, in France, faced French judges. The lesson the next generation drew was structural: distribute the company so that no single lever reaches all of it. Build the implant in one country, sell it from another, hold the intellectual property in a third, bank in a fourth, and if any one node is exposed or shut down, route around it and reconstitute under a new name in a friendlier jurisdiction.

That is what the Intellexa alliance is: not a firm that happens to operate internationally, but an intentional dispersal, engineered so that the whole is always somewhere the current investigator is not. The spyware is the product it sells. The corporate maze is the product that protects it.

2. The Instrument: Predator, and capability parity with Pegasus

The spyware itself matters less to this letter than the structure, but it has to be established, because a great deal turns on the fact that Predator is not a cheap imitation of the market leader. It is a peer.

The European Parliament's inquiry into the Pegasus scandal — the investigation into the abuse of commercial spyware across Europe — states it directly: 'In Greece the evidence points to Predator. A piece of spyware similar to Pegasus, Predator too is developed by Israeli software companies (operating under the name Intellexa).' Similar to Pegasus. That comparison is the important one, because Pegasus, NSO Group's product, is the most notorious and most capable mercenary spyware on earth, documented on the phones of journalists, activists and heads of state worldwide. To place Predator beside it is to say the top-tier capability is not one company's crown jewel but a market's baseline.

And Google's report describes what a government customer actually gets, which is the full FinFisher promise matured into a console. It is, the report says, 'an end-to-end infection, spyware, and analysis solution.' The customer uses 'Intellexa's user interface to build the lure links, send the links through a variety of channels, monitor the status of the exploitation and installation of the spyware agent, and finally command the spyware implant to find and exfiltrate the desired data,' across both iOS and Android. Read that as FinSpy Mobile from Letter F, ten years on and vastly better: pick a target, generate a lure, watch the infection land, own the phone. The infect-the-endpoint modality that FinFisher pioneered and that killed FinFisher is here, alive, refined to Pegasus grade, sold from behind a corporate maze.

The significance of the parity is strategic. When the most dangerous capability in the industry exists at roughly equal quality across several independent vendors and alliances, no single takedown removes it. Sanction Intellexa and Predator's customers can shop at NSO; constrain NSO and they can shop at Intellexa or the next alliance. The capability is a property of the market, not of any firm, and that is precisely why the firms invest so heavily in being unkillable.

3. The Deployment: the euphemism comes home

Every vendor letter in this register has documented the same gap between the brochure word 'lawful' and the actual target, and every earlier one placed that gap somewhere reassuringly distant. Amesys's EAGLE was in Gaddafi's Libya. Blue Coat's boxes were in Assad's Syria. FinFisher's FinSpy was on Bahraini dissidents. The comfort in those cases — never stated, always present — was that this is what happens over there, in dictatorships, to other people. Intellexa is the letter that removes that comfort, because Predator did not turn up in a far-off autocracy. It turned up inside the European Union.

In Greece, an EU member state, Predator was documented on the phones of a financial journalist, Thanasis Koukakis, and the leader of an opposition party, Nikos Androulakis — the affair the Greek and European press named Predatorgate, and which the European Parliament's PEGA committee formally investigated. A journalist and an opposition politician, surveilled by mercenary spyware, inside a democracy, in the 2020s. The euphemism-gap did not merely narrow; it collapsed entirely. 'Lawful interception' — the phrase every vendor in this register hides behind — here resolved to the phone of a reporter investigating financial corruption and the phone of a man running against the government.

The dossier holds its line on what is and is not established. That Predator was on those phones is documented by the technical research and examined by the EU inquiry. The further question — who ordered it, and how far up the Greek state the authorisation ran — was the contested heart of a political scandal, and this letter does not adjudicate it; the government's precise role remains disputed. But the fact that matters for the register does not depend on resolving that dispute. A Pegasus-class mercenary implant, sold by a structured-to-hide alliance, ended up surveilling a journalist and an opposition leader inside the European Union. Whatever the chain of authorisation, that is the euphemism come home, and it is why Intellexa is not just another foreign vendor but a warning that the market it belongs to has no safe distance left in it.

4. The Accountability: sanctions, versus a structure built to survive them

Intellexa, being an alliance rather than a company, and being spread across jurisdictions that mostly will not extradite or prosecute at the request of the aggrieved, is hard to reach by the levers that reached the earlier vendors. There is no single Germany to revoke its licence, no single Munich to raid it. So the response, when it came, tried a new lever, and it is a lever this register had not yet recorded.

In 2024 the United States sanctioned it. The Treasury's Office of Foreign Assets Control designated the Intellexa Consortium, its founder Tal Dilian, and a set of associated companies and individuals spread across the alliance's jurisdictions; the Commerce Department added Intellexa entities to the Entity List. The mechanism is financial and technological strangulation: cut the alliance and its principals off from the US banking system, from US technology, from the ability to transact in dollars or buy American components. It is a serious tool, aimed not at one node but at the named people and entities across the structure, and it is the strongest action any government in this register has taken against a still-living spyware vendor.

And it collides head-on with the thing the alliance was built to be. A consortium engineered from the start to have no single centre, to relocate, to reconstitute under new names in new jurisdictions, is the specific corporate form that sanctions on named nodes struggle most to dissolve. Sanction the entities you can name, and the capability can re-emerge under entities you cannot yet — a new alliance, new brand, same expertise, in a jurisdiction outside the sanction's reach. The accountability and the evasion were designed against each other, and the evasion had a decade's head start. This is why the verdict is not DISSOLVED, as FinFisher's was, but something more frustrating: sanctioned, and shaped to outlast the sanction.

5. The Bridge: the industry re-consolidates, and the record is the answer

Every letter carries the actor to what the LSN systems and the record show today, and for Intellexa the bridge is the register turning back on itself, because Intellexa is where the earlier letters converge.

It is, first, the living present of the dead modality. FinFisher (Letter F) closed on DISSOLVED, and INHERITED — the company ended, the modality was inherited. Intellexa is the inheritor named: the same infect-the-endpoint, defeat-encryption-by-owning-the-device capability, executed at a quality FinSpy could only aspire to, sold by an organisation built to avoid FinFisher's fate. Everything the encryption transition of the first alphabet made inevitable — the migration of surveillance from the wire to the device — is here, mature, sanctioned, and still selling.

And it is, second, the industry visibly re-consolidating. The surveillance business does not so much die as recombine, and the clearest evidence is that the register's first actor reappears in its ninth: reporting on the Intellexa milieu has linked it to Nexa Technologies — the successor to Amesys, Letter A, whose executives were charged over Libya. The people, the capabilities and the money of the exposed vendors do not vanish when a brand is burned; they reassemble under new names and new alliances, which is exactly what the alliance model is for. A register of named actors, followed far enough, stops being a list of separate companies and becomes the portrait of a single industry shedding and regrowing its skins.

Against that — an alliance designed for opacity, spread beyond any one jurisdiction's reach, re-consolidating faster than it can be sanctioned — the platform holds no jurisdiction and commands no takedown, as it has held none throughout. What it holds is the record. It can document the structure that is built to be undocumentable, name the components the brand exists to blur, keep the list of the journalist and the politician the spyware was found on, and note the sanctions and their limits. That is the one thing an alliance engineered for invisibility cannot fully defeat: a witness that writes down what it was, who it was, and whom it was used against, so that when it reconstitutes under a new name, the new name has a history attached to it.

6. The counter-narrative, steelmanned

The defence of Intellexa, and of the commercial-spyware market it belongs to, is the same one made for FinFisher, sharpened by a decade of the 'going dark' problem getting worse, and it deserves its strongest form.

End-to-end encryption is now the default, the argument runs, and it protects criminals and terrorists as effectively as it protects everyone else. Democratic law-enforcement and intelligence services facing genuine threats — organised crime, terrorism, hostile foreign operations — have, lawfully and increasingly, no option but the endpoint, and a European vendor selling a targeted implant to European democracies for warranted use against real suspects is providing a legitimate and necessary capability that those states cannot easily build themselves. The alliance structure, on this account, is not sinister but ordinary: multinational technology companies routinely distribute their operations across favourable jurisdictions for tax, talent and regulatory reasons, and a spyware firm doing the same is not uniquely guilty of anything. And the abuses, real as they are, are the customers' misuse — a government that points a lawful tool at a journalist has broken its own law, and the vendor is no more culpable than a carmaker whose vehicle is used in a crime.

This dossier grants the encryption dilemma and the legitimacy of warranted endpoint access — it granted both to FinFisher — and rejects the rest, because the specifics defeat the generalities. The 'ordinary multinational structuring' defence does not survive the detail that the structure is optimised not for tax or talent but for exactly the property that a tax-optimised company does not need: the ability to survive an export-control denial and a criminal investigation by having no reachable centre. Legitimate businesses do not, as a rule, architect themselves primarily to be unprosecutable. And the 'customers misused it' defence collapses on Predatorgate specifically: a vendor selling a Pegasus-class implant into a market it knows, from a decade of documented cases, will be pointed at journalists and opposition politicians is not a naive carmaker; it is a supplier with full knowledge of the foreseeable use, choosing a corporate form designed to insulate itself from the consequences of that use. The going-dark problem is real and warranted endpoint access can be legitimate. An alliance built to sell that capability with the accountability engineered out, into a market whose abuses are documented and expected, is not the solution to the dilemma. It is a business model that profits from the dilemma while structuring away the responsibility.

7. Verdict — SANCTIONED, and STRUCTURED-TO-SURVIVE

Intellexa took the modality that killed FinFisher — the endpoint implant, the infection answer to encryption — and wrapped it in the one thing FinFisher lacked: a corporate structure designed so that no single government could ever reach the whole of it. It built Predator to Pegasus grade, sold it across borders through a maze of allied entities, and watched its product turn up not in a distant dictatorship but on the phones of a journalist and an opposition politician inside the European Union. And when the strongest response yet devised — US sanctions on the alliance and its named founder — finally came, it met a company that had been built, from its first day, to outlast exactly that.

The verdict's first word is the register's newest: SANCTIONED. The United States did to Intellexa what had not been done to a living spyware vendor in this series — designated the consortium, named and sanctioned Tal Dilian, Entity-Listed the entities, and moved to cut the whole structure off from the American financial and technological system. It is the most serious accountability action in the vendor half of this register, and it is real.

The second word is why it is not enough: STRUCTURED-TO-SURVIVE. The alliance is the specific corporate form that financial sanctions on named nodes are least able to dissolve — spread across six jurisdictions, engineered to relocate, reconstitute and rebrand, built by people who had watched the single-country vendors die and drew the structural lesson. Sanction the names you can see, and the capability can re-emerge under names you cannot, in the incestuous re-consolidation the register keeps finding: the Amesys people reappearing as Nexa, the Nexa milieu linking to Intellexa, the whole industry shedding brands and regrowing them faster than any one lever can cut. FinFisher was DISSOLVED because it was reachable. Intellexa was built to be sanctioned and survive it, which it may.

Nine actors in, the register's hardest truth about the surveillance industry is fully visible in this one. You can charge the executives (Amesys), fine the reseller (Blue Coat), bankrupt the company (FinFisher), sanction the alliance (Intellexa) — and the capability persists, because it is a market, its firms are engineered to be replaceable, and its people simply reassemble. The vectors do not lie: Predator is Pegasus-class, the journalist and the politician were real, the sanctions are real, the structure built to outlast them is real. Judge the alliance that made accountability an engineering problem and then solved it — for itself.

The Alphabet of Actors continues. Verdict: SANCTIONED, and STRUCTURED-TO-SURVIVE. Confidence: HIGH on the alliance structure, the product, the capability parity and the lineage — drawn from Google's Buying Spying report and the EU Parliament's Pegasus inquiry in the LSN archive. MEDIUM, and explicitly bounded, on the Predatorgate deployment (documented by technical research and the EU inquiry; the authorisation chain contested and not adjudicated here), the US sanctions (stated as executive designations of record), and the Nexa/Amesys linkage (public reporting). Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the business model that engineered accountability away.