Notorious spyware ‘Predator’ that had spied on journalists, businessmen and politicians was developed in North Macedonia

The Predator spyware marketed to the world by an Israeli software company and used in Greece and Egypt to spy on journalists, dissidents and others, was developed in North Macedonia – in violation of the Balkan country’s laws. But local efforts to investigate why the software was built in Skopje appear stalled. The European Parliament is also probing the matter.

On June 19, 2022, a few months after it was revealed that Predator spyware had infected Greek journalist Thanassis Koukakis’s mobile phone, a group of North Macedonian parliament members arrived in Geneva to participate in an intense training to improve their oversight of the country’s intelligence agencies and to ensure that these agencies respect human rights and democratic standards. Hosted by the Geneva Centre for Security Sector Governance, also known as DCAFGeneva Centre for Security Sector Governance, nine members of North Macedonia’s Parliament Commission for Oversight of the Work of the National Security Agency and Intelligence Agency, together with a dozen representatives from other North Macedonia government institutions, attended a training entitled “Highly invasive means like IMSI catchers, malicious software – their purpose and use.”

But the report lacked information about how that had been allowed to happen in North Macedonia, in what was a clear violation of its laws.

The trainer asked the participants what they were doing to shine light on this disturbing discovery.

“I remember we all proudly said: ‘Yes, we did ask the North Macedonian authorities. They told us they are already working on the problem. The staff from the Ministry of Interior told us investigative measures are underway to determine the circumstances and that the MPs will know accordingly once they have answers’”, former Minister of Interior and current MP Pavle Trajanov told IRL’s reporters in a face-to-face meeting.
The group would meet again five months later, on November 14, 2022, this time at the mountain resort of Mavrovo in North Macedonia. For this second raining, representatives from the North Macedonian Ministry of Interior, the Intelligence Agency, the Bureau for Public Security and the Agency for National Security also attended.
The guest list included some high level representatives including Victor Dimovski, the director of the North Macedonia Agency for National Security.

In light of events in neighboring Greece, where it was revealed in 2022 that journalists, government ministers and members of the opposition had been spied on by the Greek government using legal wiretapping procedures and the illegal spyware Predator, the parliamentarians would express new concerns, asking whether the North Macedonia government also possessed sophisticated spying software.

“Director Viktor Dimovski, after some nagging with us, said ‘yes, but claimed that so far they have never used it’”, Trajanov told IRL. But the parliamentary group asking the questions received few details – they are still looking for them.

Recent history shows that it is not particularly surprising that spy software is being developed in North Macedonia, or recently in BulgariaThe Covert Reach of NSO Group | Forensic News, both countries with weak regulations and even weaker oversight.

A tech savvy city with a sketchy tech history becomes a spyware hotspot

In 2015 the Macedonian secret police and high level government officials were implicated in a scandal regarding illegal telephone surveillance on a massive scale – more than 20,000 individuals were wiretapped between 2008 and 2015, while Nikola Gruevski’s government was in power.

The then-director of the Administration for Security and Counterintelligence Saso Mijalkov was alleged to have illegally interceptedThe Macedonian surveillance scandal that brought down a government | Computer Weekly conversations from 5,827 phone numbers, of more than 20,000 individuals.The targets included civil society activists, politicians from all parties, journalists, diplomats, businessmen.

In a related matter, Mijalkov was also investigated in 2016 by the Special Public Prosecutors in North Macedonia for running covert internet surveillance using the sophisticated spy software known as Finfisher. Goran Grujevski and Nikola Boskovski, two of Mijalkov’s closest confidantes among intelligence officers, were cited for destroyingНов случај Тврдина: Во МВР била уништена опрема за прислушување вредна 10 милиони евра | mkd.mk the equipment in an attempt to sabotage the prosecutors’ investigations.

In October 2017, Grujevski and Boshkovski were arrested in Greece, where they had requested political asylum. A court in Thessaloniki ruled they both should be extradited because they did not meet the conditions for political asylum. This decision, however, was overturned by Greece’s Supreme Court. The high court ruled that because they had been pardoned by then-President of North Macedonia Gjorge Ivanov, from the government that had succeeded Gruevski, they did not need to be extradited. They had been awaiting trial on charges of destroying the spying equipment in the wiretapping scandal, and could have faced 15 years in prison. President Ivanov’s pardon was widely criticized as a clear effort to protect a small circle of former ruling party members and their associates from criminal charges. In 2016 Ivanov revoked the pardon after a huge public outcry. But the two men then received asylum and are living in Greece.

That wiretap scandal in North Macedonia might have put an end to the authoritarian regime of the nationalist party led by Nikola Gruevski, but it did not end the connections between the weak Balkan democracy and worldwide spyware traders. At almost the same time that the wiretap scandal was winding down, North Macedonia was already becoming a host country for the development of what would become one of the most notorious spy software programs: Predator.

From wine and weapons to developing spyware
In early 2017, then-26-year-old Macedonian entrepreneur Ivo Malinkovski left his position as head of Chateau Kamnik, his family’s wine producing company, and founded and operated several tech startups in Skopje. His business became the development and production of the Predator.

Ivo Malinkowski receives an award from the Chamber of Commerce of North Macedonia in 2015 for one of the wines from the family’s winery.

In the early months of their existence, on October 6, 2017, two of the companies that Malinkovski ran –Cytrox and Cyshark– would ask the North Macedonian Ministry of Interior for authorization for manufacturing, sale and resale, and export of several software products that could be used to protect personal data – and to invade personal data. This was spelled out in classified documents obtained by IRL and Inside Story. The companies would be selling this equipment to governments and certified government agencies such as secret services, police, border agents, and marine police, the classified documents said. North Macedonia’s Ministry of Interior said it never authorized the production of the spyware. It also said it was unaware that it was being produced – but the documents tell a different story: the government was alerted to the plans to produce spyware, a violation of North Macedonian law.

What was in the application

Among other things, the application wrote: We note that our activity is the subject of work exclusively for the creation and production of software that we would offer as a final product on the domestic and foreign market only for government uses, as well as for special needs and purposes that fall under the authority of state authorities authorized by law and institutions.
Signed by Malinkovski, the application said that the products the companies sought to create are regulated under the Law for Interception of Communication. Accordingly, the Ministry of Interior should have reviewed their full application, but there is no evidence or documentation to show that such a review occurred.

The manufacture, offer for sale, resale, import, export, re-export or possession of means of monitoring communications may not be carried out without an authorization issued by the Ministry of Interior. The approval from paragraph 1 of this article is issued on the basis of a submitted written request, in addition to which a technical specification of the type and characteristics of the means intended for monitoring communications must be submitted.

The applications sent on behalf of Cytrox and Cyshark were not complete. Malinkovski had neglected to attach the specifications of the equipment that the law required. North Macedonia’s Ministry of Interior gave the companies extra time to deliver the required documents, allowing them an additional month. The government unit tasked to review and authorize such products isthe Counterintelligence Unit in the Ministry of Interior, better known to residents of North Macedonia as the Secret Police.

On November 7 2017, Malinkovski filed a new document with specifications that the original application had lacked. According to classified documents obtained by IRL and Inside Story, and reviewed by tech experts at IRL’s request, the software product in question is what would later be known as Predator, the linchpin of the global scandal. It features a sophisticated weapon to target civil society activists, journalists and other high value targets. Some of those, it was revealed later, were in neighboring Greece. It also was soon revealed that the smartphone surveillance system –the Predator spyware– was used by authoritarian hostile governments and paramilitary organizations around the world, such as the infamous Rapid Support Forces militia in Sudan and the government of Myanmar.

Public records in Skopje show that the CEO is Ivo Malinkovski. Rumors were spreading that the father, not the son, is actually behind the company, but Ilija Malinkoski denied the allegations in an interviewWine, Weapons and WhatsApp: A Skopje Spyware Scandal | Balkan Insight with Balkan Insight. “Cytrox was reported to be part of IntellexaIntellexa, the so-called ‘Star Alliance of spywareThe Lucrative Government Spyware Industry Has a New ‘One-Stop-Shop’ for Hacking Everything | Gizmodo’, which was formed to compete with NSO Group, and which describes itself as ‘EU-based and regulated, with six sites and R&D labs throughout Europe’”, the Citizen Lab report said.

But the software developed in Skopje for Intellexa was never granted the required authorization by the Ministry of Interior.

IRL reporters talked with an officer in the Ministry of Interior tasked to handle the application. The first to respond had refused to make a recommendation. “I was not qualified to understand what the software is, so I gave it to another officer,” this person said. At least three sources in the Counterintelligence unit confirmed for IRL that no one wanted to deal with this request. The Ministry of Interior then said in an email to IRL that they did not approve the Cytrox and Cyshark requests.

The reasons for this reluctance may well be rooted in the wiretap scandal, which was revealed in 2015. ”The Ministry of Interior has not authorized such software for the companies in question, nor has the Ministry of Interior purchased such software”, spokesperson Toni Angelovski said in an email dated December 15, 2022.

The North Macedonian connection

North Macedonia once made global headlines stemming from another Citizens Lab report, which revealed in 2015 the Gruevski government’s massive wiretapping scandal. And the tiny Balkan nation was again in the headlines on December 16th 2021, when NGO Citizen Lab in cooperation with Meta published two new reports. This time the focus was on the Predator software produced by Intellexa’s company Cytrox, based in Skopje. On the same day, the North Macedonian prime minister Zoran Zaev, who was on his way out of office, hosted a party in the exclusive winery Chateau Kamnik. The winery is owned by the Malinkovski family who are not only vintners, but have also been arms traders for almost three decades – and now, recent entrants into the cyber software business. But, while the revelers sipped on wine, very few knew that the family whose winery hosted the party was at that moment deeply involved in one of the world’s hottest spying affairs, linked to the use of Predator.

The arms business operates under the brand Mikei International, but the Malinkosvki family keeps their affairs away from the public spotlight. There is only one record of a press interview but no TV appearances, no hint of any scandals. When Mikei was sanctioned by the US government in 2009 for trading weapons with hostile regimes, no media reports were made. Unless you are a politician or a journalist, you would not know of their international weapons trade business. It is mostly under the public radar. For ordinary North Macedonians, the Malinkovski family is known as winemakers of Chateau Kamnik, a very popular brand.

The family’s weapons business and other enterprises remained under the public’s radar until 2017, when Ivo Malinkovski began to appear frequently in the media as a rising star in the global tech world.
According to official documents reviewed by IRL in the North Macedonia Business State Registry, there is ample evidence of Dilian’s footprint in North Macedonia. The Skopje-based company Cytrox was founded in March 2017 as a joint stock company by six foreign businessmen – five from Israel (Dror Harpaz, Sharon Adler, Avraham Rubinstein, Eyal Avraham Oren, Alon Arabov) and one from Hungary (Rotem Farkas). Ivo Malinkovski was listed as their CEO. According to the separate registry of true owners, the beneficiary owner of Cytrox was Meir Shamir, a former air force veteran from Israel. All have ties to Tal Dilian, according to various public documents on file in several countries. Dilian is the head of Intellexa.

The filings also show that Dilian was broadening his holdings in North Macedonia. Four other companies were registered at the same address in Skopje – each of them with connections to Tal Dilian’s associates: Cyshark, Cygnet, Cintellexa and Cyberlab. All of them were registered between 2017 and 2020. Avraham Rubinstein appears among beneficiary owners in Cytrox and Cyberlab together with Rotem Farkas, while the latter’s father, Moshe, is co-owner of Cyshark together with Ivo Malinkovski. All have business connections to Dilian.

“It was one company basically, we all worked in the same offices and we were all working on the same tasks. Many of the employees had no idea how many companies were registered, we just know we worked for Intellexa. The pay was better than excellent, so no one cared”, an employee who wished to remain anonymous told IRL.

The former employee, who is also a software engineer, confirmed that what was being produced was Predator, although they did not know where or how it was being sold. “We also trained the employees in Greece. Everything was controlled from here because the main product of all Intelexa operations was in Skopje”.

The Skopje office was frequently visited by various Israelis, according to sources and data from border police. The employee could not say who they all exactly were, but he was familiar with one man: Shahak Shallev. “He was the main guy, he was sent here from the start by the Israelis to oversee the operations of production”.

Who is Shahak Shalev

One of the companies registered in Skopje was CyberLab. It was run by the R&D director of Intellexa, Shahak Shalev, former top cybersecurity intelligence officer in the Israeli Military.

IRL can confirm that Shalev resided in North Macedonia from 2017 until the end of September 2022, at the height of the wiretapping scandal in Greece, which led to several government investigations and the resignation of the Greek director of the Intelligence Services (EYP) and the prime minister’s right hand and nephew, Grigoris Dimitriadis.

CyberLab, according to the official documents, was managed by Ivo Malinkovski, but the true owner was a Dutch company called Inpedio, owned by Avraham Rubenstein and Rotem Farkas. Shahak Shalev, based on his bio on his Linkedin profile, remains the Vice President of Technology at Inpedio. Both cyber companies, Cytrox and Inpedio, received initial funding back in 2017 by the state-owned israeli Aerospace Industry.

Skopje as a haven for former Intellexa Greek employees
At least two former Intellexa employees working in Athens were tracked down by reporters frequently visiting Skopje, even after they stopped working for the Greek company. According to travel and other data collected by reporters, their visits to North Macedonia most likely started in the second half of 2022, right after the revelation of the phone tapping of another prominent Greek politician, Nikos Androulakis, the leader of Greece’s socialist opposition party PASOK.
“We were tasked to recruit and hire, for example, personnel in Athens”, said the former employee.

At the moment, the offices of Cytrox in Skopje appear closed, as reporters witnessed. Public business registry records in North Macedonia show that there were changes in the ownership structure for Cyshark, one of the companies owned by Moshe Izrael Farkas. Now, at least on paper filed with the business registry, it is owned and run by the retired grandmother of Ivo Malinkovski on his mother’s side, Kalja Angelova.
In the meantime, Cytrox from North Macedonia is recently receiving more attention from the European Parliament.

A Dutch member of the European Parliament and rapporteur of the PEGA Committee, Sophie in ‘t Veld, presented in a press conferencePress conference by Sophie IN ‘T VELD, rapporteur on the PEGA Draft Report | European Parliament the findings of the committee’s draft report, developed within a seven-month period and said that all member-states of the European Union have such software available, even if they do not admit it. On page 36, a chapter is devoted to the North Macedonian connections.

The Dutch MP wrote to Tal Dilian asking for details.“The company Cytrox, hosted by Intellexa, began as a start-up in North Macedonia, but according to ForbesA Multimillionaire Surveillance Dealer Steps Out Of The Shadows… And His $9 Million WhatsApp Hacking Van | Forbes, you saved it from bankruptcy with five million dollars. It seems that the corporate structure is widely spread, with corporate presence in Hungary, Israel and share transfer in a corporate entity on the British Virgin Islands. Could you please provide us with information on your current and previous role in Cytrox as well as the link between Cytrox and Intellexa? Can Intellexa comment on why it is present on the British Virgin Islands? Can Intellexa clarify whether Cytrox transferred part of its shares on the British Virgin Islands?” states the letter to Dilian, which has not been answered.

According to Sophie in ‘t Veld, however, the problem was that the software was abused, which constitutes an enormous threat for democracy on the whole continent.

“Unfortunately, the upcoming Greek elections are causing the media to recycle legends and fairy tales about our activities. We have no intention of participating in this witch hunt, as we are not involved in the election campaign.

“’Fully regulated by EU law’ is a sales slogan, it is empty unless Intellexa explains exactly what rules it is referring to and how it complies. They have already been fined for not cooperating with the Greek authorities and for breaking the rules in Cyprus. Apparently they exported spy software to Sudan, which seems to violate EU export rules. In addition, Intellexa has refused to cooperate with the European Parliament. They never responded to any of our letters and invitations, yet they took the time to have their lawyers send angry letters to the PEGA committee.

The North Macedonia Ministry of Internal Affairs claimed in an email to IRL that they never issued approval for the production and sale of this software and that their responsibility ended there. Experts disagree, as does the North Macedonia Parliament committee tasked to follow the work of security agencies. North Macedonia’s Ministry of Interior should have filed a criminal complaint, these experts said.

Svetlana Nikoloska, professor of Security Sciences at the Faculty of Security of the “St. Kliment Ohridski” University, said that the North Macedonian institutions should be very attentive to the problem of illegal monitoring of communications. Moreover, for such illegal activities, the Ministry of the Interior should act automatically in coordination with the public prosecutor, she added. “Such illegal behaviors are contained in several criminal acts that are prosecuted ex officio”, said Nikoloska.

“The Ministry of the Interior had information that the North Macedonian company Cytrox plans to import and export communications surveillance software. Although they claim to have never authorized the request for production of this software, the ministry should have done more”, Nikoloska said.

She cited Article 286 of the North Macedonia Criminal Code, which stipulates a fine or a sentence of up to three years in prison for anyone who, with the intention of unauthorized production, puts into circulation, imports, exports, or distributes a protected topography of an integrated circuit or software.

“If the software used in Greece for monitoring communications was produced in our country, measures and actions can be taken to discover, shed light and provide evidence only at the request of the Greek police. That cooperation goes on a bilateral level or through INTERPOL, but there should be a specific request, and in that case the department for computer crime and digital forensics can work on the case”, Nikoloska said. But so far, there has been no effort to coordinate. Greek judicial sources said that they have not contacted the North Macedonian authorities in Skopje on the matter of production of illegal spyware. Asked in Nicosia, Cyprus, where the main export activity of Dilian’s company is coordinated, Cypriot judicial authorities confirmed that they were not in contact with their North Macedonian counterparts on the matter./Inside Story/

https://insidestory.gr/article/predators-control-centre-has-its-roots-skopje