Eight Greeks sue Intellexa over Predator spyware surveillance

Eight Greek citizens whose phones were infected with Predator spyware have filed a civil lawsuit against the surveillance technology company Intellexa and 13 individuals linked to the firm. The lawsuit, filed Tuesday, seeks roughly €7.6 million ($8.7 million) in total damages.

The plaintiffs include a former Meta security manager, financial journalist Thanassis Koukakis, two lawyers, a former director of the Hellenic Police’s Forensic Laboratories, the ex-head of a Greek intelligence agency, journalist Spyridon Sideris, and a former intelligence and law enforcement official. Their lawyer, Zacharias Kesses, told Greek outlet Ekathimerini that the compensation is meant to address “the moral damage suffered by the victims from the illegal violation of their privacy, the confidentiality of their communications and their personal data.”

How the Predator spyware scandal unfolded

The scandal erupted in 2022 when forensic investigators found traces of Predator spyware on dozens of phones belonging to journalists, politicians, and business figures. The revelations triggered a political crisis. Greece’s intelligence service chief resigned, and so did the prime minister’s chief of staff. In February, a Greek court sentenced Intellexa’s founder, Tal Dilian, and three associates to more than 126 years in prison. Under Greek law, however, they will serve only eight years. They remain free while the appeals process plays out.

The lawsuit details “the structure, operation and division of roles of the network of companies and individuals associated with the development, distribution and use of Predator,” Kesses said. He called the legal action “the next institutional step towards full accountability of all those involved and redress for victims, both at national and European level.” A trial is scheduled to begin in April 2027.

Tal Dilian blames Greek government

In March, weeks after the prison sentences were handed down, Dilian gave an interview to a local news outlet claiming he was being made a scapegoat for the Greek government’s own wrongdoing. He insisted Intellexa sold Predator exclusively to government customers — in this case, the Greek government and its national intelligence agency. Dilian accused the government and intelligence agency of committing a “conspiratorial criminal act” designed to cover up their own malfeasance. He maintains Intellexa provides the spyware to government clients and has no role in selecting targets.

That defense hasn’t swayed the victims. The plaintiffs argue Intellexa and its associates bear direct responsibility for the illegal surveillance that invaded their private lives. The case is one of the first major civil lawsuits in Europe targeting a spyware manufacturer, and it could set a precedent for how courts handle privacy violations enabled by commercial surveillance tools.

What the victims are seeking

Each victim is claiming compensation for specific harms: invasion of privacy, breach of confidential communications, and misuse of personal data. The total €7.6 million demand reflects the severity of the violations, according to Kesses. The lawsuit also names 13 individuals tied to Intellexa, though Kesses did not specify their roles. The legal filings reportedly lay out the corporate structure and operational links between the companies and people involved in the Predator supply chain.

The case has drawn attention from privacy advocates across Europe. It highlights the growing tension between governments that buy spyware for law enforcement and the companies that manufacture it. Critics argue that once spyware is sold, vendors lose control over how it’s used — and that governments often target journalists, lawyers, and political opponents rather than criminals.

For the eight Greek plaintiffs, the lawsuit is about more than money. It’s about holding Intellexa accountable for building and selling a tool that was used to spy on them. The trial in 2027 will be a key test of whether spyware makers can be held liable for the actions of their government customers.

Stolen Credentials Now Drive the Majority of Ransomware Incidents

Cybercriminals have shifted tactics. A new analysis from Sophos shows that compromised logins are now the primary way ransomware gets inside a network. The report, based on real-world incidents, found that 79% of ransomware attacks trace back to an initial intrusion that exploited legitimate user credentials or abused identity systems.

That’s a major jump. It means the front door — a stolen password or a phished login — is now far more dangerous than a software bug.

“Over the last 12 months across the ransomware landscape we’ve seen attackers rely on ‘easier’ attacks, using compromised identities as the primary initial access vector,” said Ross McKerchar, CISO at Sophos, in a statement to Infosecurity. He pointed to advances in social engineering, including AI-polished phishing emails and sophisticated ClickFix campaigns designed to trick even trained users into bypassing multi-factor authentication (MFA).

How Attackers Get In: Phishing, Brute Force, and Old Vulnerabilities

The report breaks down the initial entry points. Malicious emails accounted for 26% of ransomware incidents, up from 19% in 2025. Phishing attacks — often used to steal credentials — were the root cause in 24% of cases, rising from 18% the previous year.

Brute force attacks came in third at 23%, a slight dip from 22% in 2025. That method relies on automation to guess weak or common passwords.

What’s falling out of favor? Exploiting known security vulnerabilities. That approach dropped from 32% in 2025 to just 18% in 2026. Attackers are choosing the path of least resistance — and that path leads straight to human error and weak identity controls.

Where Stolen Logins Are Used: VPNs, Firewalls, and IoT Devices

Once attackers have a valid login, they don’t stop at one system. The report details how exploited identities are used to move laterally. In 38% of cases, attackers accessed exposed applications or systems. Remote device logins accounted for 30%, firewalls for 21%, and exposed VPNs for 8%. Even IoT devices served as an initial point of entry in 3% of incidents.

That breadth of access points means a single compromised password can open multiple doors. No wonder identity-based attacks are surging.

Why Organizations Are Still Getting Caught Off Guard

Sophos surveyed 2,158 cybersecurity leaders. Their answers reveal persistent gaps. 62% cited security gaps in the network — both known and unknown — as a reason attacks went undetected. Over half (58%) said their organization was held back by a lack of people or expertise. And 57% felt they hadn’t implemented the right level of cybersecurity protections.

The message is clear: tools alone aren’t enough. Teams need the right skills and the right configurations to make identity-based defenses work.

Ransom Payments: Smaller Demands, But More Victims Paying

The report also tracks ransom demands. The median demand has fallen to $698,000, down from $2 million just two years ago. But that doesn’t mean attackers are getting softer. They’re tailoring demands to each victim. Smaller organizations get smaller asks. If the ransom seems “reasonable,” victims are more likely to pay — especially if they fear downtime will cost more than the ransom itself.

Among organizations that had data encrypted, 48% paid the ransom. Meanwhile, 66% used their own backups to restore some data, up from 54% in 2025. That’s progress, but it’s not a silver bullet.

How to Defend Against Identity-Based Ransomware Attacks

The Sophos report offers clear guidance: treat identity as a foundational security layer, not an afterthought. “Organizations should prioritize identity threat detection and response (ITDR), enforce multi-factor authentication across all access points, and regularly audit both human and non-human identity credentials,” the report recommends.

That means ransomware protection strategies must start with identity hygiene. Enforce MFA everywhere. Monitor for unusual login patterns. Audit credentials regularly. And don’t forget non-human identities — service accounts and API keys are often overlooked.

For readers looking to strengthen their defenses, a good place to start is understanding common phishing attack techniques and how to spot them. Training alone won’t stop every attack, but combined with strong identity controls, it raises the bar.

The bottom line? Attackers are going where the defenses are weakest — straight at the login screen. Organizations that lock that door first will have the best chance of keeping ransomware out.

Five Londoners Charged in ‘Russian Coms’ Vishing Probe

British police have charged five people from London in connection with a notorious fraud platform that enabled millions of scam calls. The suspects are accused of running and promoting National Crime Agency described as a cybercrime-as-a-service operation that tricked victims into handing over cash and personal data.

The charges include conspiracy to supply articles for fraud, money laundering, and failing to provide phone passcodes when ordered. All five are due to appear at Westminster Magistrates’ Court on August 14, 2026.

What Was Russian Coms?

Launched in 2020, Russian Coms started as a physical handset before evolving into a web-based app. Criminals used it to spoof caller IDs — making it look like they were dialing from banks, telecoms firms, or even law enforcement agencies.

“They allowed criminals to hide their identity by appearing to call from pre-selected numbers,” the NCA said in a statement. The goal was simple: convince victims their accounts were compromised and persuade them to transfer money to a “safe” account controlled by the scammers.

By the time the platform was shut down in 2024, it was linked to over 1.3 million scam calls targeting half a million UK phone numbers — plus many more overseas.

Who Are the Accused?

The five individuals charged are:

• Ayoub Sehailia, 28
• Zakkaria Sehailia, 30
• Usman Din, 30
• Denis Ozmus, 29
• Fadila Salem, 53

All are from different parts of London. Their court date is set for August 2026, more than two years away — a sign of the complexity of the case.

A Cybercrime-as-a-Service Empire

Russian Coms was marketed aggressively on Snapchat, Instagram, and Telegram. The package sold to fraudsters included “unlimited minutes,” “hold music,” encrypted calls, voice-changing tools, and 24/7 support.

The handset version came preloaded with VPN apps to hide the user’s IP address and a burner app that wiped the phone clean at the touch of a button. A six-month contract cost between £1,200 ($1,600) and £1,400 ($1,870), depending on delivery method.

Victims lost tens of millions of pounds, the NCA estimates. Fraud now accounts for 41% of all crime in the UK, with over two-thirds of it cyber-enabled.

Broader Crackdown on Fraud Gaining Ground

This case is part of a wider push by UK authorities. In January 2025, three men were sentenced at Snaresbrook Crown Court for running OTP.Agency, a site that helped fraudsters bypass multi-factor authentication (MFA) to hijack bank and telecom accounts.

More recently, Operation Henhouse 5 led to more than 500 arrests, freezing orders against £9 million ($12 million), and seizures of cash and assets worth £18.1 million ($24.3 million).

Still, the scale of the problem is daunting. The NCA says fraudsters are constantly adapting, using platforms like Russian Coms to stay one step ahead. The charges announced today are a reminder that law enforcement is catching up — but the fight is far from over.