US Treasury Removes Sanctions on Intellexa Predator Spyware Executives
The US Treasury Department, under the Trump administration, has removed three individuals previously sanctioned for their involvement with the Intellexa consortium, the group behind the Predator commercial spyware platform. These individuals—Sara Hamou, Andrea Gambazzi, and Merom Harpaz—were originally sanctioned by the Biden administration in 2024 for their roles in managing and distributing Predator, which has been linked to surveillance activities targeting dissidents, journalists, and political opponents. The Treasury stated that the delistings were part of a normal administrative process following petitions for reconsideration, with each individual demonstrating steps to separate themselves from Intellexa. Despite the removals, concerns remain among researchers and human rights advocates, as recent investigations indicate that Intellexa continues to operate Predator and has expanded its targeting capabilities, including the use of malicious mobile advertisements for infection.
The decision to lift these sanctions signals a shift in US policy toward commercial spyware vendors, with critics warning that it may embolden the use of surveillance tools by authoritarian regimes. The move follows earlier actions by the Trump administration to ease restrictions on other spyware companies, raising questions about the future of US efforts to curb the proliferation of commercial surveillance technology. The Predator spyware remains a significant concern for national security and human rights, as it enables extensive device tracking, data theft, and surveillance operations on infected devices.
Timeline
Jan 2, 2026
Treasury removes three former Intellexa-linked individuals from sanctions list
The Trump administration removed three Iranians from the U.S. sanctions list after a petition and evidence presented to the Treasury Department indicated they had separated themselves from Intellexa. The delisting reversed sanctions imposed in 2024 over their alleged involvement with the Predator spyware consortium.
Dec 1, 2025
Investigations find Predator spyware still operating despite sanctions
By late 2025, investigations reported that Intellexa was still operating the Predator spyware platform despite prior U.S. sanctions. The findings fueled continued human rights concerns and criticism over the effectiveness of the sanctions regime.
Jan 1, 2024
Biden administration sanctions three Iranians tied to Intellexa
In 2024, the U.S. government sanctioned three Iranian individuals for their roles in the Intellexa consortium, the commercial spyware operation behind Predator. The sanctions were part of broader U.S. action against spyware actors linked to abuses and surveillance activity.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Sources
Related Stories
U.S. Treasury Removes Sanctions on Intellexa Predator Spyware Executives
The U.S. Department of the Treasury has lifted sanctions on three individuals—Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou—who were previously designated for their roles in the Intellexa Consortium, the company behind the Predator commercial spyware. These individuals had been sanctioned in 2024 for their involvement in developing, operating, and distributing Predator, as well as for facilitating the consortium’s financial and managerial operations. The reasons for their removal from the sanctions list have not been disclosed, and it is unclear whether they continue to hold their previous positions within the organization. The reversal marks a significant shift in the U.S. government’s approach to countering commercial spyware manufacturers, following earlier efforts that included sanctions, blacklisting, and international agreements targeting such companies. Digital rights advocates have expressed concern that lifting these sanctions could undermine accountability for those involved in the proliferation of spyware, which has been used by governments and other actors to conduct invasive surveillance through zero- and one-click attacks. The Treasury Department has not provided further comment on the decision, and the move has prompted calls for greater transparency regarding the evidence supporting the delisting.
1 months ago
Ongoing Global Deployment and Corporate Expansion of Intellexa Predator Spyware
Researchers have uncovered continued deployment of the Predator spyware, developed by Intellexa, in multiple countries despite U.S. sanctions and increased scrutiny. New evidence indicates active use in Iraq, with additional operations linked to entities in Pakistan, Saudi Arabia, Kazakhstan, Angola, and Mongolia. Some countries, such as Egypt, Botswana, and Trinidad and Tobago, appear to have ceased communication with Intellexa, though this may reflect changes in infrastructure rather than a halt in activity. The spyware has been used against civil society members, business executives, and other high-value targets, with its costly licensing model suggesting a focus on strategic individuals. Ongoing legal proceedings against former Intellexa executives in Greece highlight the international concern over the company's activities. Recorded Future’s Insikt Group has mapped a complex global network of individuals and entities associated with Intellexa, including those involved in backend development, infrastructure setup, and product distribution. Export and import data reveal that Intellexa’s products have been shipped to clients in various regions, with new evidence of product imports in Kazakhstan and the Philippines. The network also includes entities in the advertising sector potentially linked to the "Aladdin" ad-based infection vector. The persistent and likely unlawful use of Predator spyware continues to pose significant privacy, legal, and physical security risks, particularly for political opposition, business leaders, and individuals in sensitive roles worldwide.
1 months ago
Intellexa Executives Sentenced in Greece Over Predator Spyware Wiretapping Scandal
A Greek court in Athens sentenced **Intellexa** founder **Tal Dilian** and three associates—**Sara Hamou**, **Felix Bitzios**, and **Yiannis Lavranos**—to prison for their roles in the “Greek Watergate” spyware scandal involving illegal wiretapping and privacy violations tied to Intellexa’s *Predator* spyware. Local reporting cited by multiple outlets indicates the court imposed sentences totaling more than **126 years**, which under Greek law translate to **eight years** to be served; the court also ordered further investigation, and the defendants are expected to **appeal** and remain free pending the appeal process. The case stems from allegations that *Predator* was used to surveil Greek targets including **politicians, journalists, businesspeople, military officials, and other public figures**, with reporting citing **more than 90** victims in Greece during **2020–2021**. Lavranos’s company **Krikel** was reported to have links to the procurement of *Predator*. The convictions mark a notable legal milestone against a commercial spyware vendor; Intellexa and associated entities have also faced international scrutiny, including **U.S. sanctions** in 2024 over alleged misuse of the spyware, and experts noted the guilty verdict and custodial sentence could increase cross-border legal exposure even if defendants attempt to avoid Greek jurisdiction.
1 months ago