Intellexa Executives Sentenced in Greece Over Predator Spyware Wiretapping Scandal
A Greek court in Athens sentenced Intellexa founder Tal Dilian and three associates—Sara Hamou, Felix Bitzios, and Yiannis Lavranos—to prison for their roles in the “Greek Watergate” spyware scandal involving illegal wiretapping and privacy violations tied to Intellexa’s Predator spyware. Local reporting cited by multiple outlets indicates the court imposed sentences totaling more than 126 years, which under Greek law translate to eight years to be served; the court also ordered further investigation, and the defendants are expected to appeal and remain free pending the appeal process.
The case stems from allegations that Predator was used to surveil Greek targets including politicians, journalists, businesspeople, military officials, and other public figures, with reporting citing more than 90 victims in Greece during 2020–2021. Lavranos’s company Krikel was reported to have links to the procurement of Predator. The convictions mark a notable legal milestone against a commercial spyware vendor; Intellexa and associated entities have also faced international scrutiny, including U.S. sanctions in 2024 over alleged misuse of the spyware, and experts noted the guilty verdict and custodial sentence could increase cross-border legal exposure even if defendants attempt to avoid Greek jurisdiction.
Timeline
Mar 25, 2026
Tal Dilian says he will appeal and hints Greek state authorized surveillance
On 2026-03-25, convicted Intellexa founder Tal Dilian said he would appeal his Greek spyware-case conviction and claimed he would not be a scapegoat, suggesting the Mitsotakis government may have been behind dozens of Predator-linked phone hacks. His remarks marked a new public response after the February convictions and raised fresh allegations about state involvement in the Greek Watergate scandal.
Feb 26, 2026
Greek court sentences four defendants to prison
On 2026-02-26, the Athens court sentenced Tal Dilian, Sara Aleksandra Fayssal Hamou, Felix Bitzios, and Yiannis Lavranos in the spyware case. The sentences totaled more than 126 years under Greek law, with each expected to serve eight years, though the sentences were stayed pending appeal.
Feb 26, 2026
Greek court convicts Intellexa founder and three associates
On 2026-02-26, a court in Athens found Intellexa founder Tal Dilian and three associates guilty of unlawful access to private communications systems and privacy and data law violations tied to the Greek spyware scandal. The defendants denied wrongdoing, and the judge indicated the case could be referred for possible additional charges.
Jan 1, 2025
Predator reportedly targets Pakistani human rights lawyer
In 2025, reporting indicated that Predator spyware was used to target a Pakistani human rights lawyer. The case further underscored continued international misuse allegations involving the spyware.
Jan 1, 2024
Amnesty reports Predator infections in Angola
Amnesty International reported in 2024 that Predator spyware infections had been identified in Angola. The finding added to evidence that Intellexa-linked spyware activity extended beyond Greece.
Jan 1, 2024
U.S. sanctions Intellexa, related firms, and key individuals
In 2024, the U.S. government sanctioned Intellexa, associated companies, and individuals including Tal Dilian and Sara Aleksandra Fayssal Hamou over Predator spyware. The sanctions were tied to allegations that the spyware was used to target Americans, including government officials and journalists.
Jan 1, 2022
Greek spyware scandal becomes public
In 2022, allegations emerged that Intellexa-developed spyware had been used in Greece to target the phones of politicians, journalists, and other prominent figures. The disclosures brought national attention to the affair later referred to as the 2022 Greek Watergate scandal.
Jan 1, 2020
Predator spyware targets more than 90 people in Greece
From 2020 to 2021, Predator spyware was used to surveil more than 90 people in Greece, including politicians, journalists, businesspeople, and military officials. These intrusions later became central to the Greek spyware scandal known as “Greek Watergate.”
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Malware
Sources
Related Stories
European Spyware Scandals Involving Predator and Paragon Targeting Journalists and Civil Society
A Greek court sentenced **four Intellexa executives** to **eight years in prison** for their role in the “**Predatorgate**” spyware scandal, which involved use of **Predator** spyware against **90+ public figures**. Prior investigations by **The Citizen Lab** and others documented Predator’s presence in Greece and confirmed infections on devices belonging to journalist **Thanasis Koukakis** and former Meta trust-and-safety manager **Artemis Seaford**, marking a rare case where executives at a mercenary spyware firm faced criminal conviction and prison time. In Italy, prosecutors in Rome and Naples confirmed via a technical report that journalist **Francesco Cancellato** and immigration activists **Giuseppe Caccia** and **Luca Casarini** showed traces consistent with **Paragon Solutions** spyware infections during the early hours of **2024-12-14**, suggesting a coordinated infection campaign. Italian authorities also inspected a Paragon spyware server used by the intelligence agency **AISI** and found evidence of operations against Caccia and Casarini but not against Cancellato, leaving attribution for Cancellato’s compromise unresolved; the case follows **WhatsApp** notifications to roughly **90** people warning they were targeted with Paragon spyware.
1 months ago
Ongoing Global Deployment and Corporate Expansion of Intellexa Predator Spyware
Researchers have uncovered continued deployment of the Predator spyware, developed by Intellexa, in multiple countries despite U.S. sanctions and increased scrutiny. New evidence indicates active use in Iraq, with additional operations linked to entities in Pakistan, Saudi Arabia, Kazakhstan, Angola, and Mongolia. Some countries, such as Egypt, Botswana, and Trinidad and Tobago, appear to have ceased communication with Intellexa, though this may reflect changes in infrastructure rather than a halt in activity. The spyware has been used against civil society members, business executives, and other high-value targets, with its costly licensing model suggesting a focus on strategic individuals. Ongoing legal proceedings against former Intellexa executives in Greece highlight the international concern over the company's activities. Recorded Future’s Insikt Group has mapped a complex global network of individuals and entities associated with Intellexa, including those involved in backend development, infrastructure setup, and product distribution. Export and import data reveal that Intellexa’s products have been shipped to clients in various regions, with new evidence of product imports in Kazakhstan and the Philippines. The network also includes entities in the advertising sector potentially linked to the "Aladdin" ad-based infection vector. The persistent and likely unlawful use of Predator spyware continues to pose significant privacy, legal, and physical security risks, particularly for political opposition, business leaders, and individuals in sensitive roles worldwide.
1 months ago
U.S. Treasury Removes Sanctions on Intellexa Predator Spyware Executives
The U.S. Department of the Treasury has lifted sanctions on three individuals—Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou—who were previously designated for their roles in the Intellexa Consortium, the company behind the Predator commercial spyware. These individuals had been sanctioned in 2024 for their involvement in developing, operating, and distributing Predator, as well as for facilitating the consortium’s financial and managerial operations. The reasons for their removal from the sanctions list have not been disclosed, and it is unclear whether they continue to hold their previous positions within the organization. The reversal marks a significant shift in the U.S. government’s approach to countering commercial spyware manufacturers, following earlier efforts that included sanctions, blacklisting, and international agreements targeting such companies. Digital rights advocates have expressed concern that lifting these sanctions could undermine accountability for those involved in the proliferation of spyware, which has been used by governments and other actors to conduct invasive surveillance through zero- and one-click attacks. The Treasury Department has not provided further comment on the decision, and the move has prompted calls for greater transparency regarding the evidence supporting the delisting.
1 months ago