The Predator spyware has resurfaced with fresh infrastructure after a drop in activity caused by US sanctions against Intellexa Consortium, Recorded Future reports.

Intellexa, based in Greece, was sanctioned in March for selling and distributing commercial spyware and surveillance tools. Three other entities were sanctioned for their roles in the development and distribution of the Predator spyware.

The malware, primarily used by government actors, allows operators to infiltrate devices and access or exfiltrate sensitive data, and even to activate the infected device’s cameras and microphones, without the user’s knowledge.

Intellexa was first mentioned in a 2021 Citizen Lab report on Cytrox’s Predator iPhone implant and the US added it to an ‘entity list’ last year, limiting its access to American-made components and technologies.

In July 2024, Cyberscoop reported a significant decline in Intellexa’s activity, noting that it could have been either caused by public exposure and imposed sanctions or the result of the company managing to avoid detection.

Recorded Future’s new report shows that the creator of the infamous Predator spyware has shifted to new infrastructure and has updated detection evasion. Its surveillance tool has been seen in multiple countries, including Angola and the Democratic Republic of the Congo (DRC).

The main change observed is the inclusion of an additional tier in the multi-tiered delivery system, designed to anonymize customer operations and make it more difficult to attribute attacks to a specific country.

Predator continues to be used against high-profile individuals, including politicians, journalists, executives, and activists, employing one-click or zero-click exploits targeting browser vulnerabilities and network access for infection.

“Even though there are no reports of fully remote zero-click attacks, like those associated with Pegasus, Predator remains a dangerous tool in the hands of those targeting high-profile individuals,” Recorded Future says.

Related: Google Catches Russian APT Reusing Exploits From Spyware Merchants NSO Group, Intellexa

Related: Information of Hundreds of European Politicians Found on Dark Web

Related: Spain Needs More Transparency Over Pegasus: EU Lawmakers

Related: In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack