Cytrox
Cytrox is a surveillance group/vendor associated with the Predator spyware. MISP Galaxy added Cytrox as a new surveillance group. The provided content identifies Predator as Cytrox's spyware and describes it as sophisticated commercial spyware used to monitor politicians, journalists, activists, and other targets globally, including in the US and UK. Google researchers detailed an exploit chain used to install Predator surreptitiously on a device, and the content states that Predator can be used in zero-click attacks. The broader reporting in the provided content links spyware such as Predator to targeting of dissidents, journalists, activists, business leaders, government officials, and IT workers, and notes that such tools can provide access to encrypted messaging apps, keystrokes, screenshots, notifications, banking apps, emails, texts, credentials, and cloud logins. No additional aliases or sub-groups for Cytrox are directly provided beyond the name Cytrox.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
27 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cytrox is known for developing Predator spyware, which is deployed via sophisticated exploit chains to compromise mobile devices. Predator has been used in targeted surveillance campaigns, often attributed to nation-state customers, against high-profile individuals.
Cytrox is known for developing Predator spyware, used to monitor politicians, journalists, and activists globally.
Named as a newly added surveillance group in MISP Galaxy.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.