Loading threat actor…
Cytrox is a commercial surveillance vendor associated with the Predator spyware platform. It is tracked in threat intelligence as a mercenary surveillance actor rather than a traditional intrusion set. Cytrox developed Predator and, with high confidence, packaged exploit chains involving multiple Chrome and Android zero-day vulnerabilities for sale to government-backed customers. Reported operations using Predator were limited in scale and targeted mobile device users through one-time phishing links delivered by email, leading to exploitation of fully patched Android devices and installation of surveillance tooling. Predator operations linked to Cytrox have been associated with government-backed customers in Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia. Public reporting has tied Predator infections to surveillance of politicians, journalists, activists, and dissidents, including the case of exiled Egyptian politician Ayman Nour. In observed Android attack chains, operators first deployed the Alien malware as a loader with remote-access functionality before installing the Predator implant. Predator provides extensive post-compromise surveillance capabilities on infected devices, including audio recording, certificate installation, and hiding applications. The broader tradecraft associated with Cytrox-linked Predator deployments includes initial access via phishing, exploitation of browser and mobile operating system vulnerabilities, persistence on mobile devices, credential and sensitive-data access typical of mercenary spyware, and exfiltration-oriented surveillance. Cytrox is part of the wider commercial spyware ecosystem alongside vendors such as NSO Group, and its tooling has been repeatedly associated with state use against civil society targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
The third campaign — a full Android 0-day exploit — was detected in October 2021 on an up-to-date Samsung phone running the then latest version of Chrome. It strung together two flaws, CVE-2021-38003 and CVE-2021-1048, to escape the sandbox and compromise the system by injecting malicious code into privileged processes.
Another intrusion, which occurred a month later and was delivered to an up-to-date Samsung Galaxy S10, involved an exploit chain using CVE-2021-37973 and CVE-2021-37976 to escape the Chrome sandbox.
Another intrusion, which occurred a month later and was delivered to an up-to-date Samsung Galaxy S10, involved an exploit chain using CVE-2021-37973 and CVE-2021-37976 to escape the Chrome sandbox.
The first of the three campaigns took place in August 2021. It used Google Chrome as a jumping off point on a Samsung Galaxy S21 device to force the browser to load another URL in the Samsung Internet browser without requiring user interaction by exploiting CVE-2021-38000.
The third campaign — a full Android 0-day exploit — was detected in October 2021 on an up-to-date Samsung phone running the then latest version of Chrome. It strung together two flaws, CVE-2021-38003 and CVE-2021-1048, to escape the sandbox and compromise the system by injecting malicious code into privileged processes.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cytrox is known for developing Predator spyware, which is deployed via sophisticated exploit chains to compromise mobile devices. Predator has been used in targeted surveillance campaigns, often attributed to nation-state customers, against high-profile individuals.
Cytrox is known for developing Predator spyware, used to monitor politicians, journalists, and activists globally.
Commercial surveillance vendor assessed to have packaged zero-day exploit chains and sold them to multiple government-backed actors, who used them in at least three campaigns to install Predator spyware on fully updated Android devices.
Named as a newly added surveillance group in MISP Galaxy.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.