Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6039 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Predator Spyware Delivery Infrastructure Contact (DNS and Firewall) - Exploitation Phase

Detects endpoints, mobile Wi-Fi/VPN clients or mobile-gateway subnets resolving or connecting to Intellexa Predator Tier 1 delivery domains (boundbreeze.com, branchbreeze.com, speedbrawse.com, mdundobeats.com, noticiafresca.net, myprivatedrive.net, craftilly.com, shopstodrop.com, trigship.com, secsafty.com, streamable-vid.com and others from the Recorded Future Insikt appendix) and the Predator and Paragon Graphite server IPs (including 46.183.184.91, Citizen Lab Fingerprint P1). A hit on one-click lure delivery infrastructure for TL-2026-6039 indicates a user (typically a journalist, activist or politician) may have tapped a malicious link (T1566.002, T1204.001) leading to exploitation (T1664).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1583.001, T1664
• Data sources: index=network sourcetype=stream:dns, index=network sourcetype=pan:traffic, DnsEvents, CommonSecurityLog
• Severity: high
• Confidence: high

Splunk SPL

index=network (sourcetype=stream:dns OR sourcetype=pan:traffic) earliest=-24h (query IN ("*boundbreeze.com","*branchbreeze.com","*speedbrawse.com","*mdundobeats.com","*noticiafresca.net","*myprivatedrive.net","*craftilly.com","*shopstodrop.com","*trigship.com","*secsafty.com","*streamable-vid.com","*canylane.com","*wtar.io","*mystudyup.com","*lawrdo.com") OR dest_ip IN ("46.183.184.91","188.166.0.154","172.233.116.151","169.239.129.77","169.239.128.46","46.30.188.19","128.199.39.196","185.243.114.170","185.236.202.161","45.143.166.125","195.54.160.224","169.239.128.42","45.86.231.100","185.158.248.139","38.54.2.119")) | eval ioc=coalesce(query, dest_ip) | stats count min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sources values(dest_port) as dest_ports by src_ip, ioc | convert ctime(first_seen) ctime(last_seen) | sort - count

Microsoft KQL

let iocDomains = dynamic(['boundbreeze.com','branchbreeze.com','speedbrawse.com','mdundobeats.com','noticiafresca.net','myprivatedrive.net','craftilly.com','shopstodrop.com','trigship.com','secsafty.com','streamable-vid.com','canylane.com','wtar.io','mystudyup.com','lawrdo.com']);
let iocIps = dynamic(['46.183.184.91','188.166.0.154','172.233.116.151','169.239.129.77','169.239.128.46','46.30.188.19','128.199.39.196','185.243.114.170','185.236.202.161','45.143.166.125','195.54.160.224','169.239.128.42','45.86.231.100','185.158.248.139','38.54.2.119']);
union
  (DnsEvents
    | where TimeGenerated > ago(24h)
    | where Name has_any (iocDomains)
    | project TimeGenerated, ClientIP, Indicator=Name, Source='DnsEvents'),
  (CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DestinationIP in (iocIps)
    | project TimeGenerated, ClientIP=SourceIP, Indicator=DestinationIP, Source='CommonSecurityLog')
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ClientIP, Indicator, Source
| order by Hits desc

Sigma

title: DNS Query to Predator Spyware Delivery Infrastructure
id: 7c1e4a90-2b5d-4f3a-8e61-0d9a3b7c52e1
status: experimental
description: Detects DNS resolution of domains attributed to Intellexa Predator Tier 1 delivery infrastructure (Recorded Future Insikt, TL-2026-6039).
references:
    - https://www.recordedfuture.com/research/predator-still-active-new-links-identified
    - https://securityaffairs.com/202922/malware/predator-pegasus-and-graphite-governments-accused-of-spyware-abuse-face-little-accountability.html
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial_access
    - attack.t1566.002
    - attack.t1664
    - attack.execution
    - attack.t1204.001
    - attack.resource_development
    - attack.t1583.001
logsource:
    category: dns
detection:
    selection:
        query|endswith: ['boundbreeze.com','branchbreeze.com','speedbrawse.com','mdundobeats.com','noticiafresca.net','myprivatedrive.net','craftilly.com','shopstodrop.com','trigship.com','secsafty.com','streamable-vid.com','canylane.com','wtar.io','mystudyup.com','lawrdo.com']
    condition: selection
falsepositives:
    - Security researchers or threat-intel sandboxes that deliberately resolve published IOC domains
    - Domains that were sinkholed or re-registered by unrelated parties after the Insikt reporting window
level: high

Known false positives:

• Threat-intelligence analysts or sandboxes intentionally resolving published Predator IOC domains
• Shared hosting IPs (for example DigitalOcean AS14061) may later be reassigned to unrelated tenants, so IP-only hits need domain corroboration

Tuning notes: Adjust index and sourcetype to your DNS and firewall data models. Source IOC list is the Insikt appendix (2024-01 to 2025-05); refresh it from TL feeds and drop entries older than your retention window. Raise priority for src_ip ranges belonging to high-risk users (journalists, activists, political staff) or mobile Wi-Fi/VPN pools. Tie hits to the user's device and recommend Lockdown Mode plus forensic review.

• 🔒 iOS Devices Below 18.3.1 Exposed to Graphite iMessage Zero-Click CVE-2025-43200 - Exploitation Exposure · unlock with TL Creds
• 🔒 Mobile Defense Spyware Detection with Camera, Microphone, Contacts or SMS Access - Post-Exploitation · unlock with TL Creds
• 🔒 Large Upload to Predator or Graphite Server IPs - Exfiltration over C2 · unlock with TL Creds
• 🔒 Web Proxy Access to Predator Delivery Domains - Exploitation Phase · unlock with TL Creds
• 🔒 Graphite Android Indicators [indicator], [indicator] and iMessage Account ATTACKER1 in Forensic Exports - Post-Exploitation · unlock with TL Creds
• 🔒 DNS Answers Resolving to Predator or Graphite Server IPs - C2 and Infrastructure Reuse · unlock with TL Creds
• 🔒 Mercenary Spyware Family or Indicator Alert from Mobile Defense (Predator, Pegasus, Graphite) - Post-Exploitation · unlock with TL Creds
• 🔒 Predator Inter-Tier Traffic on TCP/10514 to Public Hosts - C2 and Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-6039.

Sample indicators (3 of 26)

• IP address: 46.183.184[.]91
• Domain: boundbreeze[.]com
• IP address: 169.239.128[.]42

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

This record consolidates reporting on three mercenary spyware families used against civil-society and political targets in Europe. The primary article (Security Affairs, 2026-11-12, summarizing IrpiMedia) is mainly accountability reporting. It names victims by country: Greek journalist Thanasis Koukakis (Predator); Polish MEP Krzysztof Brejza (Pegasus, 85,000 messages covering ten years accessed, some conversations altered and broadcast by national TV); Hungarian journalist Szabolcs Panyi (Pegasus for seven months in 2019, about 100 MB moved to and from the phone); at least 65 people linked to the Catalan independence movement in Spain, mostly 2017-2020, per Citizen Lab; and Mediterranea Saving Humans activists Luca Casarini, Beppe Caccia and David Yambio in Italy (Paragon Graphite).

Predator (Intellexa): The Koukakis case used fake appointment messages and article invitations as lures, consistent with one-click social-engineering delivery. Predator gives covert access to contacts, documents and messages and can activate the camera and microphone. Recorded Future Insikt Group describes a multi-tier delivery architecture: Tier 1 victim-facing C2/delivery servers, Tier 2 and Tier 3 upstream VPS hops linked over TCP port 10514, Tier 4 static in-country ISP IPs suspected to be customer-controlled, and a Tier 5 linked to the Czech entity FoxITech s.r.o. The platform is modular and Python-based, supports Android and iPhone, uses 1-click and zero-click (network injection or proximity) delivery, and uses fake 404, login, under-construction and conference sites. Domains previously impersonated local news outlets and since late 2023 use random English (sometimes Portuguese) words, mostly registered via PublicDomainRegistry (PDR Ltd.). Suspected operator countries over the past two years: Angola, Armenia, Botswana, DRC, Egypt, Indonesia, Kazakhstan, Mongolia, Mozambique, Oman, Philippines, Saudi Arabia, Trinidad and Tobago. ICIJ reports that on 2026-02-26 an Athens court convicted Tal Dilian, Sara Hamou, Felix Bitzios and Yiannis Lavranos of breaching telecom confidentiality and illegally accessing information systems, with prison terms of up to eight years suspended pending appeal. The court referred the record for possible further offenses, but the article reports the Supreme Court prosecutor declined to reopen the case. Court records show nearly one-third of Predator targets were also under Greek intelligence surveillance.

Graphite (Paragon): Citizen Lab Report 186 (2025-06-12) gave the first forensic confirmation of Graphite on iOS. An iMessage zero-click attack, exploiting CVE-2025-43200 (mitigated by Apple in iOS 18.3.1), compromised the iPhone of Fanpage.it journalist Ciro Pellegrino and an anonymous prominent European journalist, whose device ran iOS 18.2.1. Both devices showed the same iMessage account 'ATTACKER1', and a server at 46.183.184.91 matched Citizen Lab's Fingerprint P1 until at least 2025-04-12. Citizen Lab assessed with high confidence that both cases belonged to a single Paragon customer. Android indicators BIGPRETZEL (Casarini, Caccia) and SMALLPRETZEL (Yambio) were also reported. Italy's parliamentary oversight body ruled the Mediterranea cases lawful.

Pegasus (NSO Group): In Poland, a parliamentary inquiry concluded in October 2026 that Pegasus was bought unlawfully and used against political opponents. In Hungary, civilian intelligence holds classified information on Panyi and all requests have been blocked on national-security grounds. The article gives no infection vector for the Pegasus or Graphite cases it covers, and no CVEs. The only CVE cited here, CVE-2025-43200, comes from Citizen Lab's Graphite report. Defenders should treat journalists, activists, opposition politicians and their staff as at-risk users: enable iOS Lockdown Mode or Android advanced protection, patch promptly, and act on vendor threat notifications.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Collection

T1429 Audio Capture; T1512 Video Capture; T1533 Data from Local System; T1636.003 Contact List; T1636.004 SMS Messages

initial-access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.003 Virtual Private Server; T1583.004 Server

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1664 Exploitation for Initial Access

Remediation

Patches

• Apple iOS 18.3.1 (mitigates CVE-2025-43200)

Immediate actions

• Enable iOS Lockdown Mode for journalists, activists, opposition politicians and their staff
• Update iOS to 18.3.1 or later to mitigate CVE-2025-43200 (iMessage zero-click used by Graphite)
• Act on Apple, WhatsApp and Meta threat notifications and seek forensic analysis (Citizen Lab, Amnesty Security Lab, Access Now)
• Block and hunt for Predator infrastructure domains and IPs listed in the IOC set on DNS, proxy and firewall logs
• Do not tap links in unsolicited appointment or article-invitation messages

Workarounds

• Disable iMessage and FaceTime on high-risk devices where operationally feasible
• Use Lockdown Mode

Longer-term hardening

• Reboot at-risk devices regularly and keep OS and apps fully patched
• Give high-risk users hardened, separately managed mobile devices and an incident-response contact
• Monitor mobile DNS and network telemetry for newly registered random-word domains hosted on the ASNs cited by Insikt
• Track legal and policy developments (EU PEGA recommendations, national inquiries)

Affected and fixed versions

• Apple — iOS (iMessage)
  Vulnerable versions: 18.2.1 (confirmed compromised); versions before 18.3.1
  Fixed in: 18.3.1
• Google / various — Android devices
  Vulnerable versions: Android devices targeted by Predator and Graphite (BIGPRETZEL, SMALLPRETZEL indicators)

Timeline

• 2023-06-15 European Parliament PEGA inquiry committee adopts recommendations on spyware abuse; the article reports they remain unimplemented.
• 2024-01-17 Earliest first-seen date in Insikt's Predator infrastructure appendix (locked-ioc-8 and locked-ioc-14 domains).
• 2025-03-05 Most recent first-seen date in Insikt's appendix (locked-ioc-12).
• 2025-04-12 Paragon server locked-ioc-11 still matched Citizen Lab's Fingerprint P1 on this date.
• 2025-04-29 Apple sends threat notifications to users affected by Graphite iMessage zero-click attacks.
• 2025-06-05 Italian parliamentary oversight body COPASIR publishes its report on the Paragon cases.
• 2025-06-12 Citizen Lab publishes 'Graphite Caught', the first forensic confirmation of Paragon Graphite on iOS; Recorded Future publishes its Predator infrastructure update.
• 2026-02-26 Athens court convicts Tal Dilian, Sara Hamou, Felix Bitzios and Yiannis Lavranos for illegal access to systems and breach of telecom confidentiality; sentences of up to eight years are suspended pending appeal.
• 2026-11-12 Security Affairs publishes a summary of the IrpiMedia investigation on lack of accountability for spyware abuse in Europe.

Sources cited

• Spied on by governments with Israeli spyware in Europe: no one pays the price (IrpiMedia) irpimedia.eu · Research
• Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware (Citizen Lab) citizenlab.ca · Research · 2025-06-12
• Predator Still Active, with New Client and Corporate Links Identified (Recorded Future Insikt Group) Recorded Future · Research · 2025-06-12
• Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability (Security Affairs) securityaffairs.com · News · 2026-11-12
• Greek court convicts Intellexa founder Tal Dilian, three others in wiretapping scandal (ICIJ) icij.org · News · 2026-02-26
• Athens court convicts four over Greece spyware saga (Neos Kosmos) neoskosmos.com · News · 2026-02-27
• Greek Court Finds Spyware Executives Guilty (Human Rights Watch) hrw.org · News · 2026-03-02
• US sanctioned Predator spyware entities (Security Affairs) securityaffairs.com · News
• A new Italian citizen was targeted with Paragon's Graphite spyware (Security Affairs) securityaffairs.com · News
• European Journalists Targeted by Paragon Spyware, Citizen Lab Confirms (Infosecurity Magazine) infosecurity-magazine.com · News · 2025-06-12

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines
• Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers

More from Intellexa Consortium

• Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targets
• Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)
• Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception

Other reports on CVE-2025-43200

• Paragon Graphite mercenary spyware: CEO admits no kill switch or misuse visibility; Citizen Lab confirmed 2025 zero-click targeting (CVE-2025-43200) of Italian and European journalists and activists