# Cytrox

> As of 2026-05-30, Cytrox is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt, malware. ATT&CK coverage spans 47 techniques across 13 tactics in 2 of 2 tracked threats. Most-observed techniques: T1041 (Exfiltration Over C2 Channel), T1068 (Exploitation for Privilege Escalation), T1070 (Indicator Removal).

- **Tracked threats:** 2
- **Categories:** APT, MALWARE
- **As of:** 2026-05-30

## ATT&CK techniques observed

47 techniques observed across 2 of 2 tracked threats. Tactics: Stealth (formerly Defense Evasion) (9), Collection (7), Resource Development (6), Discovery (5), Initial Access (4), Command and Control (3).

- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 2 of 2 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 2 of 2 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 2 of 2 tracked threats
- [T1123](https://intel.threadlinqs.com/technique/T1123) Audio Capture — Collection — observed in 2 of 2 tracked threats
- [T1125](https://intel.threadlinqs.com/technique/T1125) Video Capture — Collection — observed in 2 of 2 tracked threats
- [T1203](https://intel.threadlinqs.com/technique/T1203) Exploitation for Client Execution — Execution — observed in 2 of 2 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1014](https://intel.threadlinqs.com/technique/T1014) Rootkit — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1037](https://intel.threadlinqs.com/technique/T1037) Boot or Logon Initialization Scripts — Persistence — observed in 1 of 2 tracked threats
- [T1055](https://intel.threadlinqs.com/technique/T1055) Process Injection — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1056](https://intel.threadlinqs.com/technique/T1056) Input Capture — Credential Access — observed in 1 of 2 tracked threats

## Tracked threats

- [Hack-for-Hire Espionage Campaign Targeting MENA Civil Society via Predator/Intellexa Mercenary Spyware](https://intel.threadlinqs.com/threat/TL-2026-0333) — HIGH
- [Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception](https://intel.threadlinqs.com/threat/TL-2026-0132) — HIGH

## Related CVEs

15 CVEs referenced by tracked Cytrox activity.

- [CVE-2025-6554](https://intel.threadlinqs.com/cve/CVE-2025-6554)
- [CVE-2025-48543](https://intel.threadlinqs.com/cve/CVE-2025-48543)
- [CVE-2024-4610](https://intel.threadlinqs.com/cve/CVE-2024-4610)
- [CVE-2023-4762](https://intel.threadlinqs.com/cve/CVE-2023-4762)
- [CVE-2023-41993](https://intel.threadlinqs.com/cve/CVE-2023-41993)
- [CVE-2023-41992](https://intel.threadlinqs.com/cve/CVE-2023-41992)
- [CVE-2023-41991](https://intel.threadlinqs.com/cve/CVE-2023-41991)
- [CVE-2023-3079](https://intel.threadlinqs.com/cve/CVE-2023-3079)
- [CVE-2023-2136](https://intel.threadlinqs.com/cve/CVE-2023-2136)
- [CVE-2023-2033](https://intel.threadlinqs.com/cve/CVE-2023-2033)
- [CVE-2021-38003](https://intel.threadlinqs.com/cve/CVE-2021-38003)
- [CVE-2021-38000](https://intel.threadlinqs.com/cve/CVE-2021-38000)
- [CVE-2021-37976](https://intel.threadlinqs.com/cve/CVE-2021-37976)
- [CVE-2021-37973](https://intel.threadlinqs.com/cve/CVE-2021-37973)
- [CVE-2021-1048](https://intel.threadlinqs.com/cve/CVE-2021-1048)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Cytrox