- Home
- Z7 Cyber intelligence
- INTELLEXA
Intellexa
CLASSIFICATION
CRITICAL THREAT
15 Zero-Days | Active in 15+ Countries | Defying US Sanctions
The Mercenary Spyware Empire Defying Sanctions
The Intellexa consortium represents the most aggressive commercial spyware operation currently active. Despite US Treasury sanctions, leaked documents confirm the company retained remote access to customer surveillance systems and developed the “Aladdin” attack vector that weaponizes the commercial advertising ecosystem for zero-click infections requiring only that victims view a malicious ad on any website.
December 2025 Developments: The “Intellexa Leaks” exposed internal training videos, sales documentation, and technical specifications. The Trump administration removed sanctions on three executives on December 30, 2025.
Incident Assessments in this report
Z7-TAF Threat Actor Analysis
Full 8-dimension assessment of Intellexa's capabilities and operations
Greece Predatorgate Scandal (2022)
92 targets, PM's nephew resigned, EYP chief resigned - Z7-BAF 8.54
Intellexa Leaks Exposure (Dec 2025)
Internal operations, TeamViewer access, customer codenames exposed - Z7-BAF 7.89
The Aladdin Threat
Intellexa’s most dangerous innovation weaponizes the advertising ecosystem. They obtain a target’s IP address from cooperating mobile carriers, create a malicious ad targeting that specific IP, and serve it through standard ad networks. Simply rendering the advertisement triggers browser exploitation. No click required.
Victims encounter malicious content on trusted news sites, social media platforms, or mobile apps they use daily. This transforms every ad-supported website into a potential infection vector.
What's in the full intelligence report
- Complete Z7-TAF Analysis: All 8 dimensions scored with detailed rationale
- 2 Full Z7-BAF Incident Assessments: Predatorgate scandal and Intellexa Leaks exposure
- Complete Intellexa Corporate History: From Unit 81 to European spyware empire
- Predator Technical Architecture: ALIEN loader, persistence mechanisms, CyOP interface
- 15 Zero-Day CVE Analysis: Chrome, iOS, Android exploitation chains documented
- Aladdin Deep Dive: Advertising-based zero-click infection methodology
- Documented Victims: Heads of state, legislators, journalists across 15+ countries
- Comprehensive Defensive Recommendations: By role (executives, security teams, IT ops, legal)
ABOUT Z7 CYBER INTELLIGENCE
Z7 Cyber Intelligence delivers threat analysis and breach assessments used by security teams, compliance officers, and executive leadership. Our proprietary Z7-TAF and Z7-BAF frameworks provide quantified, defensible scoring that enables data-driven risk decisions.
Proprietary Methodology
Z7-TAF (Threat Actor Framework) and Z7-BAF (Breach Assessment Framework) are proprietary scoring systems developed by Z7 Solutions. Both frameworks evaluate subjects across seven weighted dimensions, producing composite scores from 0.0 to 10.0 that map to four classifications: Low (0.0-3.0), Moderate (3.1-5.5), High (5.6-7.5), and Critical (7.6-10.0). Detailed scoring criteria, dimension weights, and assessment rubrics are proprietary. Complete methodology documentation is available under NDA for clients.