✨ 2026 Futuriom 50: Highlights →Explore ✨

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In December 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) removed three individuals previously sanctioned for their involvement with Intellexa and its Predator commercial spyware from the Specially Designated Nationals (SDN) list. The individuals—Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou—were linked to leadership and distribution roles within the Intellexa Consortium. Their removal followed a petition and OFAC’s evaluation that they had separated themselves from the Intellexa ecosystem, but no underlying details or independent confirmation were disclosed. The original sanctions stemmed from their roles in developing, distributing, and enabling Predator software, a tool implicated in high-profile surveillance of civil society figures, including journalists and activists, through stealth zero-day and social engineering attacks.

This case underscores the continued risks posed by commercial spyware vendors and associated compliance exposures. Ongoing public reporting highlights Predator’s persistent activity despite regulatory efforts, as well as geopolitical pressures that drive international balkanization and new attack trends targeting sensitive sectors. With regulatory frameworks evolving and threat actors shifting tactics, the risk of spyware misuse for human rights abuses and espionage remains acute.

Why This Matters Now

The removal of sanctions from individuals previously implicated in commercial spyware operations signals regulatory uncertainty and potential loopholes for actors seeking to legitimize or rebrand surveillance technology. As spyware threats proliferate across global supply chains and civil society targets, clear policy direction and robust compliance measures are urgently needed to mitigate the risk of abuse.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The US Treasury stated the sanctions removal resulted from a petition and demonstrated steps by the individuals to separate themselves from the Intellexa Consortium. Specific details remain undisclosed.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Applying Zero Trust segmentation, east-west traffic control, encrypted traffic enforcement, egress filtering, and continuous threat detection would have significantly constrained Predator spyware operations by limiting initial access, lateral movement, covert communications, and data exfiltration.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline inspection could detect or block known exploit signatures in network traffic.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Microsegmentation would prevent elevated access or workload privilege escalation.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west controls restrict lateral movement to permitted identities and services.

Command & Control

Control: Cloud Firewall (ACF) & Inline IPS (Suricata)

Mitigation: Outbound C2 channels are detected and blocked via inline signature inspection.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement blocks or alerts on suspicious data flows to unauthorized destinations.

Impact (Mitigations)

Anomaly and threat detection generate alerts for unusual access patterns and outbound flows.

Impact at a Glance

Affected Business Functions

  • Communications
  • Data Security
  • Legal Compliance
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $5,000,000

Data Exposure

Potential exposure of sensitive communications, personal data, and confidential business information due to unauthorized access facilitated by the Predator spyware.

Recommended Actions

  • • Implement Zero Trust Segmentation and microsegmentation to restrict lateral movement and enforce least-privilege access across workloads.
  • • Enforce east-west and egress network security controls to detect and prevent unauthorized internal or outbound communications associated with spyware or C2.
  • • Deploy inline cloud firewalls and IPS solutions for signature-based threat prevention and real-time inspection of both inbound and outbound flows.
  • • Ensure continuous threat detection, anomaly baselining, and behavioral monitoring to rapidly identify and respond to suspicious activity.
  • • Centralize multicloud visibility and policy enforcement through a unified Cloud Native Security Fabric to monitor, audit, and control cloud traffic and identities.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image