# Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability

> An IrpiMedia investigation, summarized by Security Affairs on 2026-11-12, documents government-linked use of commercial spyware (Intellexa Predator, NSO Group Pegasus, Paragon Graphite) against journalists, activists and politicians in Greece, Poland, Hungary, Spain and Italy. An Athens court convicted four Intellexa-linked individuals including Tal Dilian on 2026-02-26, but nobody has been identified as ordering the surveillance and EU PEGA recommendations remain unimplemented.

- **Published:** 2026-11-14T04:54:08Z
- **Last reviewed:** 2026-11-14T04:54:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6039
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6039.png
- **ID:** TL-2026-6039
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Intellexa Consortium (Israel)
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)
- **CVEs:** CVE-2025-43200

## Description

This record consolidates reporting on three mercenary spyware families used against civil-society and political targets in Europe. The primary article (Security Affairs, 2026-11-12, summarizing IrpiMedia) is mainly accountability reporting. It names victims by country: Greek journalist Thanasis Koukakis (Predator); Polish MEP Krzysztof Brejza (Pegasus, 85,000 messages covering ten years accessed, some conversations altered and broadcast by national TV); Hungarian journalist Szabolcs Panyi (Pegasus for seven months in 2019, about 100 MB moved to and from the phone); at least 65 people linked to the Catalan independence movement in Spain, mostly 2017-2020, per Citizen Lab; and Mediterranea Saving Humans activists Luca Casarini, Beppe Caccia and David Yambio in Italy (Paragon Graphite).

Predator (Intellexa): The Koukakis case used fake appointment messages and article invitations as lures, consistent with one-click social-engineering delivery. Predator gives covert access to contacts, documents and messages and can activate the camera and microphone. Recorded Future Insikt Group describes a multi-tier delivery architecture: Tier 1 victim-facing C2/delivery servers, Tier 2 and Tier 3 upstream VPS hops linked over TCP port 10514, Tier 4 static in-country ISP IPs suspected to be customer-controlled, and a Tier 5 linked to the Czech entity FoxITech s.r.o. The platform is modular and Python-based, supports Android and iPhone, uses 1-click and zero-click (network injection or proximity) delivery, and uses fake 404, login, under-construction and conference sites. Domains previously impersonated local news outlets and since late 2023 use random English (sometimes Portuguese) words, mostly registered via PublicDomainRegistry (PDR Ltd.). Suspected operator countries over the past two years: Angola, Armenia, Botswana, DRC, Egypt, Indonesia, Kazakhstan, Mongolia, Mozambique, Oman, Philippines, Saudi Arabia, Trinidad and Tobago. ICIJ reports that on 2026-02-26 an Athens court convicted Tal Dilian, Sara Hamou, Felix Bitzios and Yiannis Lavranos of breaching telecom confidentiality and illegally accessing information systems, with prison terms of up to eight years suspended pending appeal. The court referred the record for possible further offenses, but the article reports the Supreme Court prosecutor declined to reopen the case. Court records show nearly one-third of Predator targets were also under Greek intelligence surveillance.

Graphite (Paragon): Citizen Lab Report 186 (2025-06-12) gave the first forensic confirmation of Graphite on iOS. An iMessage zero-click attack, exploiting CVE-2025-43200 (mitigated by Apple in iOS 18.3.1), compromised the iPhone of Fanpage.it journalist Ciro Pellegrino and an anonymous prominent European journalist, whose device ran iOS 18.2.1. Both devices showed the same iMessage account 'ATTACKER1', and a server at 46.183.184.91 matched Citizen Lab's Fingerprint P1 until at least 2025-04-12. Citizen Lab assessed with high confidence that both cases belonged to a single Paragon customer. Android indicators BIGPRETZEL (Casarini, Caccia) and SMALLPRETZEL (Yambio) were also reported. Italy's parliamentary oversight body ruled the Mediterranea cases lawful.

Pegasus (NSO Group): In Poland, a parliamentary inquiry concluded in October 2026 that Pegasus was bought unlawfully and used against political opponents. In Hungary, civilian intelligence holds classified information on Panyi and all requests have been blocked on national-security grounds. The article gives no infection vector for the Pegasus or Graphite cases it covers, and no CVEs. The only CVE cited here, CVE-2025-43200, comes from Citizen Lab's Graphite report. Defenders should treat journalists, activists, opposition politicians and their staff as at-risk users: enable iOS Lockdown Mode or Android advanced protection, patch promptly, and act on vendor threat notifications.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1566.002 Spearphishing Link
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.004 Server
- T1429 Audio Capture
- T1512 Video Capture
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1533 Data from Local System
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Predator Spyware Delivery Infrastructure Contact (DNS and Firewall) - Exploitation Phase** (`TL-2026-6039-SPL-001`)

Detects endpoints, mobile Wi-Fi/VPN clients or mobile-gateway subnets resolving or connecting to Intellexa Predator Tier 1 delivery domains (boundbreeze.com, branchbreeze.com, speedbrawse.com, mdundobeats.com, noticiafresca.net, myprivatedrive.net, craftilly.com, shopstodrop.com, trigship.com, secsafty.com, streamable-vid.com and others from the Recorded Future Insikt appendix) and the Predator and Paragon Graphite server IPs (including 46.183.184.91, Citizen Lab Fingerprint P1). A hit on one-click lure delivery infrastructure for TL-2026-6039 indicates a user (typically a journalist, activist or politician) may have tapped a malicious link (T1566.002, T1204.001) leading to exploitation (T1664).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1583.001, T1664
- **Data sources:** index=network sourcetype=stream:dns, index=network sourcetype=pan:traffic, DnsEvents, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype=stream:dns OR sourcetype=pan:traffic) earliest=-24h (query IN ("*boundbreeze.com","*branchbreeze.com","*speedbrawse.com","*mdundobeats.com","*noticiafresca.net","*myprivatedrive.net","*craftilly.com","*shopstodrop.com","*trigship.com","*secsafty.com","*streamable-vid.com","*canylane.com","*wtar.io","*mystudyup.com","*lawrdo.com") OR dest_ip IN ("46.183.184.91","188.166.0.154","172.233.116.151","169.239.129.77","169.239.128.46","46.30.188.19","128.199.39.196","185.243.114.170","185.236.202.161","45.143.166.125","195.54.160.224","169.239.128.42","45.86.231.100","185.158.248.139","38.54.2.119")) | eval ioc=coalesce(query, dest_ip) | stats count min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sources values(dest_port) as dest_ports by src_ip, ioc | convert ctime(first_seen) ctime(last_seen) | sort - count
```

### Microsoft KQL

```kql
let iocDomains = dynamic(['boundbreeze.com','branchbreeze.com','speedbrawse.com','mdundobeats.com','noticiafresca.net','myprivatedrive.net','craftilly.com','shopstodrop.com','trigship.com','secsafty.com','streamable-vid.com','canylane.com','wtar.io','mystudyup.com','lawrdo.com']);
let iocIps = dynamic(['46.183.184.91','188.166.0.154','172.233.116.151','169.239.129.77','169.239.128.46','46.30.188.19','128.199.39.196','185.243.114.170','185.236.202.161','45.143.166.125','195.54.160.224','169.239.128.42','45.86.231.100','185.158.248.139','38.54.2.119']);
union
  (DnsEvents
    | where TimeGenerated > ago(24h)
    | where Name has_any (iocDomains)
    | project TimeGenerated, ClientIP, Indicator=Name, Source='DnsEvents'),
  (CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DestinationIP in (iocIps)
    | project TimeGenerated, ClientIP=SourceIP, Indicator=DestinationIP, Source='CommonSecurityLog')
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ClientIP, Indicator, Source
| order by Hits desc
```

### Sigma

```yaml
title: DNS Query to Predator Spyware Delivery Infrastructure
id: 7c1e4a90-2b5d-4f3a-8e61-0d9a3b7c52e1
status: experimental
description: Detects DNS resolution of domains attributed to Intellexa Predator Tier 1 delivery infrastructure (Recorded Future Insikt, TL-2026-6039).
references:
    - https://www.recordedfuture.com/research/predator-still-active-new-links-identified
    - https://securityaffairs.com/202922/malware/predator-pegasus-and-graphite-governments-accused-of-spyware-abuse-face-little-accountability.html
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial_access
    - attack.t1566.002
    - attack.t1664
    - attack.execution
    - attack.t1204.001
    - attack.resource_development
    - attack.t1583.001
logsource:
    category: dns
detection:
    selection:
        query|endswith: ['boundbreeze.com','branchbreeze.com','speedbrawse.com','mdundobeats.com','noticiafresca.net','myprivatedrive.net','craftilly.com','shopstodrop.com','trigship.com','secsafty.com','streamable-vid.com','canylane.com','wtar.io','mystudyup.com','lawrdo.com']
    condition: selection
falsepositives:
    - Security researchers or threat-intel sandboxes that deliberately resolve published IOC domains
    - Domains that were sinkholed or re-registered by unrelated parties after the Insikt reporting window
level: high
```

**Known false positives:**

- Threat-intelligence analysts or sandboxes intentionally resolving published Predator IOC domains
- Shared hosting IPs (for example DigitalOcean AS14061) may later be reassigned to unrelated tenants, so IP-only hits need domain corroboration

**Tuning notes:** Adjust index and sourcetype to your DNS and firewall data models. Source IOC list is the Insikt appendix (2024-01 to 2025-05); refresh it from TL feeds and drop entries older than your retention window. Raise priority for src_ip ranges belonging to high-risk users (journalists, activists, political staff) or mobile Wi-Fi/VPN pools. Tie hits to the user's device and recommend Lockdown Mode plus forensic review.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- iOS Devices Below 18.3.1 Exposed to Graphite iMessage Zero-Click CVE-2025-43200 - Exploitation Exposure (locked: unlock with TL Creds)
- Mobile Defense Spyware Detection with Camera, Microphone, Contacts or SMS Access - Post-Exploitation (locked: unlock with TL Creds)
- Large Upload to Predator or Graphite Server IPs - Exfiltration over C2 (locked: unlock with TL Creds)
- Web Proxy Access to Predator Delivery Domains - Exploitation Phase (locked: unlock with TL Creds)
- Graphite Android Indicators [indicator], [indicator] and iMessage Account ATTACKER1 in Forensic Exports - Post-Exploitation (locked: unlock with TL Creds)
- DNS Answers Resolving to Predator or Graphite Server IPs - C2 and Infrastructure Reuse (locked: unlock with TL Creds)
- Mercenary Spyware Family or Indicator Alert from Mobile Defense (Predator, Pegasus, Graphite) - Post-Exploitation (locked: unlock with TL Creds)
- Predator Inter-Tier Traffic on TCP/10514 to Public Hosts - C2 and Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `46.183.184[.]91`
- Domain: `boundbreeze[.]com`
- IP address: `169.239.128[.]42`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability (Security Affairs)](https://securityaffairs.com/202922/malware/predator-pegasus-and-graphite-governments-accused-of-spyware-abuse-face-little-accountability.html)
- [Spied on by governments with Israeli spyware in Europe: no one pays the price (IrpiMedia)](https://www.irpimedia.eu/en/spied-on-by-governments-with-israeli-spyware-in-europe-no-one-pays-the-price/)
- [Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware (Citizen Lab)](https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/)
- [Predator Still Active, with New Client and Corporate Links Identified (Recorded Future Insikt Group)](https://www.recordedfuture.com/research/predator-still-active-new-links-identified)
- [Greek court convicts Intellexa founder Tal Dilian, three others in wiretapping scandal (ICIJ)](https://www.icij.org/news/2026/02/greek-court-convicts-intellexa-founder-tal-dilian-three-others-in-wiretapping-scandal/)
- [Athens court convicts four over Greece spyware saga (Neos Kosmos)](https://neoskosmos.com/en/2026/02/27/news/greece/athens-court-convicts-four-over-greece-spyware-saga/)
- [Greek Court Finds Spyware Executives Guilty (Human Rights Watch)](https://www.hrw.org/news/2026/03/02/greek-court-finds-spyware-executives-guilty)
- [US sanctioned Predator spyware entities (Security Affairs)](https://securityaffairs.com/160018/laws-and-regulations/us-sanctioned-predator-spyware-entities.html)
- [A new Italian citizen was targeted with Paragon's Graphite spyware (Security Affairs)](https://securityaffairs.com/184340/security/a-new-italian-citizen-was-targeted-with-paragons-graphite-spyware-we-have-a-serious-problem.html)
- [European Journalists Targeted by Paragon Spyware, Citizen Lab Confirms (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/european-journalists-paragon/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6039