Mapping the Web of Commercial Spyware: Targets and Attack Chains

A comprehensive new report spanning 2010 to 2025 reveals the evolving landscape of commercial spyware vendors (CSVs), exposing how private firms infiltrate devices, who they typically target, and the infection chains that deliver covert implants.

The study, produced by a leading cybersecurity intelligence firm, traces the lineage from early pioneers like Gamma Group’s FinFisher (FinSpy) and Italy’s Hacking Team with its Remote Control System (RCS) to modern giants such as NSO Group, Candiru, and the Intellexa consortium.

It notes that the Arab Spring prompted governments to seek off-the-shelf tools for surveillance, with European firms like Amesys supplying “Eagle” for mass internet monitoring and later rebranding under Bull Group before becoming Intellexa Predator. The article highlights how CSVs evolved between 2016 and 2021 into turn-key operations, introducing one-click and zero-click infection vectors and multi-layered C2 networks, sometimes using geofencing and protocol rotation to evade detection.

Activation fees rose from €1,100 for FinFisher in 2011 to €8 million for Predator installations in 2022, underscoring the lucrative and contested nature of this market. It also mentions lawsuits and sanctions, including Meta’s $167 million verdict against NSO for WhatsApp exploits and U.S. Entity List designations aimed at constraining operations.