Predator Spyware: Who Is Watching Armenia?

The Companies: Intellexa and Cytrox

Confirmed - Corporate Records Confirmed - International Reporting

The commercial surveillance ecosystem at the center of this investigation involves two interlinked entities:

Intellexa marketed Predator as a "lawful intercept" tool for government clients. The spyware can remotely access a target's smartphone -- messages, calls, camera, microphone, location, and encrypted communications -- with zero-click or one-click delivery. Cytrox, the North Macedonian parent, developed the core technology. Intellexa S.A., registered in Athens, handled the sales and client relationships.

These are not theoretical capabilities. Citizen Lab, Amnesty International, and the European Parliament have all documented Predator deployments against journalists, opposition figures, and government officials across multiple countries.

The Timeline: Summer-Fall 2021

Confirmed - Multiple Sources Critical Finding

The documented events cluster within a narrow window:

The sequence is: an NSS official writes about expanding surveillance capabilities (July-August 2021), senior Armenian officials fly to Greece on a private jet (September 2021), and surveillance infrastructure appears in Armenia (October 2021). Greece -- the destination of the trip -- is where Intellexa S.A. was headquartered.

The Greece Connection

Confirmed - Flight Records Pattern Analysis

The September 2021 trip to Mykonos, Greece raises specific questions:

We are not claiming this trip was for spyware procurement. We are documenting that senior Armenian officials traveled on a private jet to the country where Predator's commercial entity was headquartered, one month before surveillance infrastructure was detected in Armenia. The coincidence of timing, destination, and subsequent events warrants scrutiny.

The NSS Paper on Surveillance Expansion

Confirmed - Published Paper Pattern Analysis

In July-August 2021 -- the exact period when the timeline begins -- the NSS Deputy Director co-authored a paper discussing the expansion of surveillance capabilities. This document was produced during the same window that leads to the detection of Predator infrastructure in Armenia two months later.

A policy paper advocating surveillance expansion, authored by the deputy head of the security service, during the same period that surveillance technology appears in the country -- this is not a coincidence that can be dismissed without investigation.

The Greek Surveillance Scandal

Confirmed - European Parliament Confirmed - International Media

In August 2022, Greece became the epicenter of Europe's largest surveillance scandal:

The same company, in the same country, that Armenian officials visited on a private jet -- was subsequently confirmed to have deployed surveillance tools against 92 targets in Greece alone. The Greek scandal confirmed that Predator was being actively marketed and deployed from Athens during the exact period of the Armenian events.

The Athens Digital Footprint: April 2018

Confirmed - Breach Data Pattern Analysis

A separate data point connects Armenian political figures to Athens through compromised credentials:

In April 2018, credentials belonging to Anna Hakobyan were compromised by Azorult stealer v3.2 from a computer with username "kingc" located in Athens, Greece (IP address in the 2.84.x.x range). This predates the 2021 events by three years, but establishes that Athens was already a node in the digital exposure of Armenian political figures.

The "kingc" computer in Athens harvested credentials from Armenian political circles in 2018 -- the year of the Velvet Revolution. Whether this was criminal, commercial, or state-sponsored remains unknown.

Breach Data: Intellexa and Cytrox Email Addresses

Confirmed - Public Breach Databases

Public breach databases contain email addresses directly referencing the surveillance companies:

The presence of intellexa@rambler.ru -- an Intellexa-branded address on the Russian email service Rambler -- raises questions about the company's connections to Russian-language markets. Similarly, cytrox@gmx.net on the German provider GMX represents a digital footprint of the parent company. These addresses appear in publicly available breach databases and may represent operational accounts, test accounts, or registration artifacts.

The Oversight Question

Pattern Analysis Critical Finding

Armenia's legal framework for surveillance procurement and deployment raises fundamental oversight questions:

The presence of the Speaker of Parliament on the Greece trip is particularly significant for oversight. If Alen Simonyan -- whose role includes legislative oversight of security services -- was aware of or involved in surveillance procurement, the separation between the monitored and the monitors collapses.

International Context: Who Else Uses Predator

Confirmed - International Research

Predator has been documented in multiple countries, establishing a pattern of authoritarian and semi-authoritarian deployment:

Every confirmed Predator deployment has targeted opposition figures, journalists, or civil society. No government has used Predator exclusively against external threats. The pattern is domestic political surveillance.

What We Know vs. What We Don't

The Timeline -- Complete

Confirmed - All Dates Documented

Evidence Summary

Surveillance infrastructure appeared in Armenia in October 2021. One month earlier, the Speaker of Parliament flew to Greece on a private jet. During the same period, the NSS Deputy Director wrote about expanding surveillance. Greece was the home of Predator. No Armenian institution has ever acknowledged, investigated, or explained any of this. The question is not whether Armenia acquired surveillance technology. The question is who is being watched -- and who decided.

Sources

This investigation draws on: Greek corporate registry records, flight records, published academic/policy papers, Citizen Lab technical reports, Amnesty International research, European Parliament PEGA Committee findings, OFAC sanctions designations, publicly available breach databases, Armenian media reporting, and open-source digital forensics. No systems were accessed or penetrated.