“She lost consciousness as it was happening and she’s actually grateful she did.” What we know about the rapes perpetrated in Ukraine by Russian soldiers
“One girl finds it difficult to speak because while she was being raped, her face was beaten, and her teeth were knocked out. In the Ukrainian language, the word for this is гугнявить,” says Ekaterina Galyant, a clinical psychologist from Kyiv, pausing at length.
She is currently in Tallinn, Estonia, working in two local maternity hospitals with refugees from Ukraine – these women aren’t necessarily pregnant, but examinations and consultations are offered to all arriving Ukrainians. Ekaterina has qualifications in both psychology and medicine, so she is “both a doctor and a psychologist” for the refugees.
Three girls that were raped by Russian soldiers – 16, 17 and 20 years old – are not currently in Tallinn. They contacted Ekaterina over social media, two of them having been advised by friends. The psychologist says that she works with them individually over Zoom: her camera is on, the victim’s remains off. Ekaterina does not know their real names and refrains from asking too many questions for now – sometimes the conversation lasts only 5-10 minutes, then the girls start crying and hang up. It’s distressing work for Ekaterina; she says she would burn out if she took on another victim of wartime assault.
“Two of the girls are from Bucha, and one is from Irpen,” Ekaterina Galyant continues. “Naturally, none of their requests literally said: “I was raped, help me.” The women mostly wrote things like: “I see no reason to live,” “I have suicidal thoughts,” “I can’t sleep,” “I can’t eat,” “I hate my body, I can’t even bring myself to touch it,” and so on. One patient with suicidal ideation found me through a channel for volunteers. We spoke over Zoom, at first I was collecting background information. I thought she might be clinically depressed and that I needed to contact a psychiatrist – only later did she tell me that she had been in Bucha and that she had been raped. And from that moment on she has been in therapy.”
All three of the girls’ stories are very similar, says the psychologist. At first it was actually confusing: “I initially thought there’s been a sole perpetrator, some kind of morally perverted monster – there are people like that during peacetime, too. But here they came in groups and all did the same thing! Maybe they had received orders or had some kind of plan… [the victims] are all basically telling the same story.”
The victims’ recollections appear to be divided into three parts, she continues: at first, the girls told her how at the beginning of the occupation the Russian military went аround their homes and noted down who was living there and whether there were men among them, and confiscated mobile phones. Then, they describe how the soldiers began looting; according to Ekaterina, “they even took an iron” from one of her clients. And about a week and a half before their retreat from Kyiv, “the atrocities started”.
“[The Russian soldiers] took all the men, and no one knows what they did to them,” says Galyant. “There were basically only women and children left [in the houses]. The father of one of the three girls was killed during the occupation: he had gone out in Bucha to find groceries and was shot, she said. She never saw the body, but one of the neighbours supposedly did. He never returned, and right now she isn’t even able to look for the body. We haven’t gone near that subject yet.”
All three girls say that the military went round the houses in groups of three to five, of various ages: “Most were young soldiers, under 30, accompanied by someone older, a 45 or 50-year-old. Someone their fathers’ age, roughly speaking” says the psychologist. In the evening they would come into the houses. All the soldiers, as the victims recall, were drunk.
“If there was some kind of booze in the house, they would take it out, sit down in the kitchen, and force the girls to cook and serve something to them – if there was anything to eat in the house. And after dinner, the raping would start” Ekaterina says. “In the girls’ cases [that Ekaterina works with], it only happened once, but it was gang rape. And the more the girls resisted, the more the soldiers… well, one girl had her teeth knocked out, she said that she screamed and tried to scratch their faces and fight back. But a 16-year-old girl against five men…”.
Ekaterina’s 17-year-old client lost consciousness during the rape: “and she’s actually grateful she did.” All three girls managed to escape from their houses when the soldiers who had raped them fell asleep. One of the girls – the one who lost her father – was spotted by a neighbour on the street.
“They took her to some house where there were people hiding in the basement,” the psychologist recounts. “She said that while waiting for the evacuation, they barricaded themselves in the basement and didn’t leave. There were people down there who had already died – there was no food, and they couldn’t take out the corpses. I asked her where they got water from: these are sewer pipes in those basements of old houses, so they made some holes in them and got a little water that way.”
Ekaterina Galyant does not know exactly where the girls who have contacted her are currently located. This is another part of their agreement. While trying to establish their medical background and provide assistance, the psychologist also learned of their physical injuries.
“One girl has abrasions, her arm is hurt badly – not broken but there’s been some severe bruising,” she says. “We’ve tried at the very least to give a rough diagnosis of what she can’t properly describe. Well, she can’t use her right hand. My biggest concern is that none of these girls have been to a gynaecologist yet. They all say that when they had a shower for the first time afterwards, they wanted to wash themselves thoroughly, to scrub off their skin. And that’s what they started doing: pouring alcohol-based solutions into their vaginas… That’s also something that really pains me. I know that two weeks or more have already passed and if they have sexually transmitted diseases or pregnancies, we need to help somehow.”
“She was sitting with a fur coat over her naked body. They had shot her in the head.”
“We have a joint application from the victims of rape aged 14 and over, some of whom are pregnant,” writes Vasilisa Levchenko, a psychotherapist from Kyiv, on her Instagram page, “pregnant by the fucking rapists. To clarify: by the occupiers, the Russian soldiers who stole gadgets and gold from their homes, who searched for a blender or a food processor to bring as a trophy to their wives, and then raped innocent Ukrainian women <…> Between us, we share out requests for help in the team chat. Three for Katya, two for Nina, and Ella takes on the hardest cases, women who are numb and can’t say a word.”
Levchenko told Mediazona that five victims of sexual violence had approached her personally. But even gathering statistics within the ‘Psychological Assistance’project she works with is still impossible: “Every day we receive hundreds of requests, I can’t imagine how we’d begin counting the ones concerning assault.”
Until early April, residents of the Zahaltsi village in the Kyiv region had to hide two young women from the Russian soldiers, as Roman Vagrant explained to Mediazona. When the war began he was in Borodyanka, and he fled to Ternopil with his family. His relatives live in Zahaltsi, the village that had been occupied by Russian soldiers since the beginning of March.
“Alcohol, cigarettes and women – that’s all they cared about.” says Roman. “Two girls had stayed in Zahaltsi. People hid them, because someone told the soldiers that there were women in the village, and they were looking for young women.”
“I heard a single shot, the sound of a gate opening, and then the sound of footsteps in the house,” a woman from a village in the Brovary district, told The Times. “It was [a soldier named Mikhail] Romanov, returning with another man in a black uniform, who looked about 20. I shouted: ‘Where’s my husband?’ They looked into the courtyard and saw him on the ground by the gate. The younger guy pointed his gun at my head and said “I shot your husband because he was a Nazi.”
According to Natalya, her young son hid in the boiler room of the house while the soldiers were raping her. She remembers that the rapists held a gun to her head and made sarcastic remarks about her. They raped her three times. “When they came back for the third time, they were so drunk they could hardly stand,” she recalled. “Finally they both fell asleep on the armchairs. I crawled to the boiler room and told my son that we needed to run away really fast or else they’d shoot us.”
Elena, from the captured city of Kherson, weeps while telling Radio Free Europe/Radio Liberty how she was raped by Russian soldiers. She had been tracked down as she was coming back from the shop: “I didn’t even have time to enter the house. They came up from behind me. I didn’t have time to grab my phone. I didn’t have time to do anything. They just threw me on the bed, silently, and took my clothes off without saying a word. At 4 o’clock in the morning they left, just like that. They didn’t talk to each other. They just called me a khokhlushka and a Banderovka. And then said, ‘Okay, we’re expected at the post. We’re off.’”
“He took me to a nearby house,” 50-year-old woman from one of the villages in the Kyiv region told the BBC. “’Take off your clothes or I’ll shoot you,’ he ordered. He constantly threatened to kill me if I didn’t do as he said. Then he started raping me. While he was raping me, four more soldiers came in. I thought I was finished. But they took him away. I never saw him again.”
She describes her rapist as “a young, slender Chechen militant.” Before raping the woman, he took her to the nearby house “at gunpoint”, and when she returned home, she saw her husband had been wounded in the stomach. There was no way to get to the hospital – there was fighting going on – and so the couple took refuge in a neighbouring house, where the husband died two days later. She buried him in the backyard.
After her husband’s death, she found out that another woman had been raped and killed in their village. When the police came to exhume her body after the Russians left, it was found naked, with a slit throat.
When Russian troops left Bucha, a nephew of one of the city’s residents found the body of a murdered woman in the basement under his barn.
“Slumped sitting down, bare legs akimbo, she wore a fur coat and nothing else,” as the New York Times report describes, “She had been shot in the head, and he found two bullet casings on the ground. When the police pulled her out and conducted a search, they found torn condom wrappers and one used condom upstairs in the house.”
“He said I reminded him of a girl from school”
One after another, reports of rape began to appear immediately after the withdrawal of Russian troops from the Kyiv region in late March. Some publications were later removed by their authors, including a post by Ukrainian journalist Alina Dubovska about a nine-year-old girl in Irpin who allegedly was raped and mutilated by 11 soldiers.
“Because of the reaction to this story, I had to hide the post about the family of the girl who was raped and then died from my page,” she explained. — “Partly as a result of the hate spewed in my direction, partly because I decided to reopen it only when the relatives allowed me to publish the evidence, so that no one would have any doubts”.
The violence did not only take place in the Kyiv region. On April 3, Human Rights Watch published a report citing the story of a 31-year-old woman from the village of Malaya Rohan near Kharkiv. One Ukrainian woman who asked not to be named described how, on the night of March 14, a Russian soldier had broken into the basement of a local school where a group of women and children were taking shelter. According to the victim, the soldier took her to a classroom on the 2nd floor and forced her to undress and perform oral sex on him at gunpoint. He slashed her face and neck with a knife: “He said I reminded him of a girl from school.”
Cases of rape have been repeatedly reported by Ukrainian officials. As far back as March 22, Ukrainian Prosecutor General Iryna Venediktova wrote that she had been “receiving reports about sexual crimes committed by the Russian military in the occupied territories”.
She added that one of the two Russian soldiers who raped Natalia, a resident of the village of Bohdanivka in Brovary district, who said that her son was hiding in a boiler room while it had been happening, had been identified. This case was also mentioned in a report by Amnesty International.
“The husband tried to protect his family,” Andriy Nebitov, head of the Kyiv regional police, said of the crime and the investigation. “He was born in 1985, a young man. He was gunned down in his own yard. <…> His wife went home with her child and tried to hide from this violence. But during the evening two men (one of them we have identified as [Mikhail] Romanov) returned to the house after consuming alcohol and under the threat of hurting her three-year-old son and shooting him in the same way they killed her husband, raped her. Apart from Romanov, there was another person, not identified by the investigation. These men were members of the Russian military. They left and then came back three more times. They raped her again, and again. Later she managed to break free and escape”.
The Verkhovna Rada Commissioner for Human Rights, Lyudmila Denisova, spoke in early April about raped children in Bucha: she said a 14-year-old girl was raped by five Russian soldiers, resulting in her becoming pregnant, and an 11- year-old boy was molested “in front of his mother”. Denisova said she also knew of many cases of sexual abuse in other places: one instance is that a group of women and girls had been held in the basement of a house for 25 days, and now nine of them are pregnant.
Oleksandr Vilkul, head of the Kryvyy Rih military administration, also spoke about rapes in Kherson Region: “We are encountering more and more terrible stories. Cases like those of a 16-year-old pregnant girl and a 78-year-old elderly lady in one of the villages near river Inhulets. This is something that can never be forgiven”.
Ukrainian President Volodymyr Zelenskyy mentioned “hundreds of rape victims” in his recent address to the Lithuanian parliament: “Including underage girls, very young children… even babies! It is horrible to speak about this, but it is true, it happened”.
Russian authorities dismiss the rape allegations. Foreign Minister Sergey Lavrov called the reports of murders and rapes in Bucha “a mendacious provocation” as early as April 5.
“Human psyche has a tolerance limit, beyond that it can endure no more.”
Victims of abuse may keep quiet about what happened to them, especially if they suffer no injuries requiring immediate medical attention, explains psychologist Ekaterina Galyant. She anticipates that over time there will be more and more calls.
For now, Ukrainian victims can call the police, hotlines for psychological support, and the office of the Prosecutor General. There is no official statistics on wartime rape cases in Ukraine, and psychologists are ethically bound not to share information about their female clients with each other or with state agencies, Galyant notes.
“Collecting information about these cases can be quite time-consuming,” says Yulia Gorbunova, a Human Rights Watch researcher in Ukraine who is now studying cases of rape in Bucha and Brovary near Kyiv. – In some conflicts, it took months and sometimes years before the true extent of these crimes came to light.”
“Due to the pervasive patriarchal structure of society, some victims understandably will not tell anyone [that they were raped],” notes volunteer Leonid Romanov, who helps Ukrainian refugee women who have been evacuated to Poland. In Poland, abortion is only possible if the life or health of the mother is at risk, so if needed, volunteers can transfer the young women across the border to other countries where abortion is not an issue. But so far no one has approached Romanov.
However, between March 1 and April 11, 99 pregnant Ukrainian citizens applied to the Polish organisation “Abortion Without Borders”, Anna Prus, a volunteer with the Warsaw-based Abortion Dream Team, told Mediazona.
“We do not ask people why they want to have an abortion, how they got pregnant, where they are from,” Anna stresses. “We are not entitled to that kind of information. People sometimes want to talk to us about what happened around a pregnancy, but it’s really depends on their desire to share the details.”
Ekaterina Galyant argues that rape during the war may cause irreparable damage: “People in wartime situations need psychological help. Post-traumatic syndrome can manifest within three to six months after the traumatic event. That is, we are all not even there now, we are currently in a very acute stage of stress. And no one doubts that all Ukrainians will need this kind of help. Human psyche has a tolerance limit, beyond that it can endure no more – it causes some kind of sickness, depression and other things. And if there is war, and then rape is on top of that – that ruins the psyche utterly.”
Flight of the Predator: Jet linked to Israeli spyware tycoon delivers surveillance tech from the EU to notorious Sudanese militia
AOJ71H 18 May 2022 10:26 Khartoum DOF/220518 C750 -LCLK -HSSK
On a dusty May morning in Khartoum an executive jet taxied to a halt under the blistering sun. Two jeeps with tinted windows stood ready to meet it from one of the most notorious and feared militias in the world, the Rapid Support Forces. The sleek white Cessna flew in from Cyprus and remained on the ground in Sudan’s capital for just 45 minutes, long enough to draw a disturbing line of connection between the ferocious contest for power in Sudan and a spyware scandal roiling Greece.
Details of the Cessna’s arrival, its passengers and cargo were meant to remain secret — logged in an inaccessible location, foregoing the usual procedures. The secrecy was a testament to the power of Mohamed Hamdan Dagalo, known as Hemedti, Sudan’s richest man and the owner of a private army that is the heir to the murderous legacy of the Janjaweed, infamous for their crimes against humanity in Sudan’s troubled Western region, Darfur.
According to three independent sources, the cargo was high-end surveillance technology, made in the European Union, with the potential to tip the balance of power in Sudan thanks to its capacity to turn smartphones into audio-visual informants on their owners. When news of its arrival reached Hemedti’s rivals the equipment was seen as so dangerous that an RSF commander speaking on condition of anonymity said it was smuggled out of Khartoum to the militia’s stronghold in Darfur to prevent its seizure by the army.
Sudan, Africa’s largest country prior to civil war and partition, is in fragile transition from decades of military dictatorship under Omar al-Bashir — now in prison awaiting possible extradition to the International Criminal Court. Waves of popular protests in Khartoum in 2019 resulted in a civilian council that shares power uneasily with the military. On paper, Hemedti is second in command to Abdel Fattah al-Burhan, commander in chief of Sudan’s Armed Forces. In reality, the militia leader vies for outright control of the country. He commands Sudan’s gold industry, his soldiers fight for a price in foreign conflicts and he has forged links to Russia’s mercenary Wagner Group. Hemedti also met with Israeli intelligence twice since June 2021, with a private jet used by Mossad tracked to Khartoum. In the last year alone, RSF fighters have been implicated in enforced disappearances of protestors in Khartoum and indiscriminate shooting of civilians, including children, in Darfur.
The Khartoum flight opened a rare window on a secretive and lucrative business, linking the blood-soaked Sudanese militia to a cabal of powerbrokers in Greece, a corporate network spanning Cyprus, the British Virgin Islands and Ireland, and above all to a crisis spreading across the EU — the widespread availability of sophisticated software that can track and hack mobile phones worldwide, threatening democratic institutions and human rights defenders.
Lighthouse Reports and its partners Haaretz in Israel and Greece’s Inside Story have been investigating the activities of Intellexa, a spyware firm whose activities spread from Europe across much of the global south. Months of digging into company records and interviews with confidential sources in multiple countries uncovered a network of companies connected to Tal Dilian, a former Israeli intelligence operative, who has bought up an array of sophisticated surveillance technology and established an EU foothold in Greece and Cyprus.
The eight-seater Cessna, which plays a significant role in Dilian’s operations, was revealed by a social media post from an Intellexa engineer – a selfie showing its subject aboard a jet with a grey leather and mahogany interior that left enough of a digital trail to isolate and identify that plane. Lighthouse Reports and partners have analysed and cross-referenced hundreds of flight records, linking the plane to key locations in Intellexa’s business, and combed dozens of passenger lists, along with corporate filings, employment records and other confidential and open source data. The findings conclusively connect the plane to Dilian, his known associates and employees in his company — including to Merom Harpaz, a central figure in his business network.
Intellexa, Tal Dilian and Merom Harpaz did not respond to requests for comment. No response was received from a Rapid Support Forces media inquiries address.
In tracing the movements of the Cessna in recent months as it criss-crossed Greece, Cyprus, Israel, the Middle East and Africa, the outlines emerge of an international scandal that destabilises the countries it lands in, all the while funnelling some of the world’s most dangerous technology into the hands of some of its most high-risk regimes.
“Equipping the RSF with sophisticated surveillance technology will not only exacerbate the brutal repression and killing of Sudan’s remarkably brave protestors and squash hopes for democracy in the region,” Anette Hoffmann, senior research fellow at the Clingendael Institute, told this investigation. “Such advanced spyware in the hands of the RSF will tilt the balance of power in favour of a ruthless former militia and Russia ally, bringing Sudan one step closer to an open confrontation with the country’s armed forces and increasing the risk of civil war.”

Publicity photo for the luxury villa complex where Tal Dilian lives in Cyprus
AOJ71H 18 May 2022 15:09 Larnaca DOF/220518 C750 -HSSK -LCLK
Returning from Khartoum that afternoon, the Cessna touched down in Larnaca, Cyprus, rolling to a halt outside the headquarters of a local aviation consultancy, Pegasus Flight Centre. Less than an hour’s drive away, in an exclusive suburb of Limassol, is a luxurious villa with an enticing kidney-shaped pool which the millionaire Israeli entrepreneur, Dilian, shares with his wife, Sara Hamou, a Polish corporate offshoring specialist.
Since leaving the Israeli army’s elite Unit 81 intelligence division, which he commanded, Dilian has specialised in surveillance tools. Basing himself in Cyprus, he first built a pioneering phone tracking firm called Circles, which he sold in 2014. He also went into business with an Israeli community leader in Cyprus, Abraham Shahak Avni, part owner of Pegasus Flight Centre.
For Avni, aviation is a fragment of a diverse portfolio. He describes himself as “a visionary entrepreneur, investor and philanthropist” whose interests span medical services, robotics, autonomous drones and intelligence products for law enforcement agencies. In partnership with Avni’s company CIS, Dilian set up a wifi interception firm called WiSpear, and kitted out a van with millions of dollars’ worth of surveillance equipment, which he began to exhibit at industry trade fairs in 2017.
Two years later, Dilian and Avni launched a more ambitious project: an “intelligence alliance” designed to “completely encompass” the needs of government agencies. The press release announced a “one-stop-shop”, a group of companies that could offer infection of devices and data extraction, wifi traffic interception, open source datamining, covert social media activities and phone geolocation, along with high powered big data analysis to make sense of it all.
In preparation for this Dilian had gone on a spending spree. He purchased Cytrox, a Hungarian and North Macedonian startup which developed phone hacking software called Predator. He brokered a marketing deal with French interception firm Nexa and invested in other companies in the area of cyber intelligence.
By uniting the capabilities of different industry niches under one roof Dilian hoped to rival the biggest players in the mercenary spyware market — in particular Israel’s NSO Group, now notorious for their Pegasus hacking software. The new alliance was to be called Intellexa.
Asked to explain the difference between NSO and Intellexa, a senior source in Israel’s offensive spyware industry said: “NSO worked in accordance with Israeli law and at times even on behalf of the state of Israel. Ethically both this firm and the Israeli policy were questionable as sales were made to oppressive regimes — but it was regulated. Intellexa on the other hand does not follow Israeli law and sells to similar but also worse clients — including those that are a risk to Israel’s own national interest. A company that does not abide by Israeli law and is not subject to any regulator is de facto a pirate organisation.”
In a sign of things to come, Intellexa’s birth into the world was accompanied by chaos. Dilian evidently intended it to be based in Cyprus, according to an undated name registration in the country’s corporate filing system. But before the paperwork was completed, the plan blew up in his face. In August 2019 he gave an on-camera interview to Forbes, in which he touted his multi-million dollar spy van, claiming it could “hack a smartphone and snoop on all the messages within” — even those protected by encrypted apps like WhatsApp and Signal. He sent a couple of colleagues off on a walk outside the van, announcing “we will trace them, we will intercept them, we will infect them.” The video, in which Harpaz can also be seen, was not well received by some factions of the Cyprus establishment who were concerned that Dilian’s operation rivalled the national intelligence agency.
Amid claims of illegal data gathering, Dilian’s employees were arrested, offices raided and equipment impounded. As warrants were issued for himself and Avni, he signalled his intention to move his base of operations elsewhere. “No company can tolerate an unstable business and legal environment, which does not provide any protection against rumours affecting corporate activities,” he said.
Faced with arrest by the Cypriot authorities, Dilian was eager for a new corporate home and he had already been putting the foundations in place since 2019 a short plane-ride away in Greece. As the police investigation into his activities in Cyprus gathered pace, Dilian had already been reorganising his business and putting Intellexa to work on behalf of his new hosts.

Photos: Reuters/Yiannis Kourtoglou, Ints Kalnins, AP/Yiannis Panagopoulos, Wikipedia, social media profiles. Art: Haaretz
AOJ71H 12 April 2022 18:41 Athens DOF/220412 C750 -LCLK -LGAV
The Cessna arrived in Athens the day after the fuse was lit on a slow-burning scandal that would come to engulf the whole of Greece’s political elite, one of its leading businessmen and a handful of other notables. The fuse was Thanasis Koukakis, a veteran business reporter described by colleagues as “dogged”, who has worked with international media including the Financial Times.
Koukakis had long suspected that his phone was tapped but discovered instead that it was also infected with Intellexa’s Predator software. Whereas spying on journalists might have provoked an outcry elsewhere in the EU, Greece is now the lowest placed European country in the rankings on media freedom published by the international watchdog Reporters Without Borders. Koukakis turned to Inside Story, a partner in this investigation, and one of the few independent investigative teams in Athens. They verified the reporter’s account, assembled the evidence and put the story out but it was largely ignored.
The Greek government denied any knowledge of Predator, blaming private actors, while its supporters in the domestic media rubbished Koukakis’ claims of a deeper scandal, saying there was no evidence of other victims. Three days after the Predator revelation a second report emerged, this time from Reporters United – another pillar of Greece’s nascent investigative scene. It published documents that showed Koukakis had been wiretapped by Greece’s intelligence agency (EYP) a year prior to his phone being infected with spyware.
The government refused to elaborate on the “national security” concerns that prompted them to intercept the calls of a respected journalist. And the EYP connection was even more troubling as the conservative government of Kyriakos Mitsotakis had changed the law within days of coming into power in 2019 to bring the intelligence agency under the direct control and oversight of the prime minister’s office — an office overseen by Mitsotakis’ own nephew, Grigoris Dimitriadis. This is the same Dimitriadis whom senior sources in Israel’s cyber industry said had previously held talks with NSO, the vendor of Pegasus.
Koukakis never believed he was alone in being targeted: “From the beginning, I considered it unlikely that such a complicated technical monitoring structure as Predator would have been set up by the Greek government to monitor only one journalist.”
The suggestion that Predator was trained on a single individual was rendered even less credible in the light of a cluster of internet domains, attributed to Intellexa’s subsidiary Cytrox, exposed by researchers from Meta and Citizen Lab, housed at the University of Toronto, Canada. This included dozens of domains mimicking Greek news sites. Lighthouse Reports used a domain intelligence database to catalogue the creation dates of the Greek lookalikes and discovered an ongoing campaign of fake news site registration, running from summer 2020. While the domains masqueraded as legitimate news sources they were in fact malicious sites that injected malware into the devices of unsuspecting visitors. Koukakis’ phone was infected after clicking on one of these links.
Documents seen by this investigation show that many of these infected domains were registered by a developer and known associate of Tal Dilian in the Czech Republic. Meanwhile, company records show that, as he moved his office out of Cyprus, Dilian had assembled a bewildering tapestry of Intellexa-linked companies spanning multiple other countries.
Dilian created his corporate network through a number of intermediaries — principally Hamou, a former senior advisor at an offshore trust specialist, but also Felix Bitzios, a businessman whose work on bad debts at Piraeus Bank was the subject of Koukakis’ reporting in 2019. Three companies called Intellexa were registered, in Greece, Ireland and the British Virgin Islands. All three were owned by an Irish holding company, Thalestris. As Inside Story dug into company registers in Greece and Cyprus they found that Thalestris also controlled companies named Apollo, Hermes, Mistrona, Dernova, Lorenco and Feroveno — some of which were seemingly registered to a rubble-strewn vacant lot in downtown Limassol. Thalestris, in turn, was partly dependent on money from another Virgin Islands entity, Chadera Enterprises, which — behind a veil of anonymity — was ultimately controlled by Dilian and two of his associates, leaked documents reveal.
Although the Thalestris holding company kept control of most of these Greek and Cypriot subsidiaries, there were two exceptions when key associates of Dilian’s work in Greece were given a piece of the pie, corporate filings reveal. Lorenco was sold to Intellexa’s top executive in Greece, Merom Harpaz, while a 35% stake in the Greek Intellexa company went to Dilian’s fixer, Felix Bitzios, via another Cyprus-based company, Santinomo.
The baffling structure served to obfuscate the links between Dilian and Intellexa, shrouding the group’s accounts in a near-impenetrable smokescreen. But on the ground, some facts remained the same as before. Feroveno, for example, shares a telephone number with Avni’s personal assistant — who corresponded with executives of Italy’s Hacking Team about the purchase of interception software in 2013; who wrote on behalf of Dilian requesting Cypriot government assistance in closing a deal with the Netherlands in 2019; and who also acts as operations director of Pegasus Flight Centre, outside which the white Cessna parked on its return from Sudan.
Following months of meticulous paperwork, Dilian’s arrival in Greece seemed to meet with success. The company’s Greek office near the abandoned airport and former refugee camp, Hellinikon, grew rapidly, expanding to a dozen employees. It was also used as a training centre and even had an area with prayer mats for those coming from Muslim countries. Flight records show the Cessna shuttling regularly between Athens, Larnaca and potential clients in the Middle East and elsewhere.

The Clarion Congress Hotel, Prague, site of ISS World Europe
AOJ71H 15 June 2022 8:01 Prague DOF/220615 C750 -LCLK -LKPR
As the white Cessna parked up in the Czech capital it was not alone on the tarmac. Delegates at the ISS World conference, hosted in an imposing business hotel east of Prague’s historic centre, were jetting in for Europe’s premier spyware trade fair. Sometimes known as the “souk of spooks”, it is a bustling marketplace for police and intelligence agencies from around the world to purchase new tools, and for the intercept companies to demonstrate them. Attendance is strictly limited to government employees and contractors, who rub shoulders and talk shop over colourful smoothies, flutes of sparkling wine and dainty pastries.
This year’s get-together came at a time of heightened European concern about the surveillance industry. The previous summer, a media consortium had thrown a spotlight on NSO Group’s Pegasus software, showing how it had been indiscriminately used by the company’s clients to hack the phones of human rights activists, politicians and journalists. As a result, the company had been sanctioned by the US and was now — along with the industry as a whole — the target of an ongoing inquiry at the European Parliament. At the opening ceremony In Prague, however, the industry’s bête noir was warmly welcomed as “the very famous NSO Group”.
Behind closed doors, salespeople gave government delegates demos of how their products could gather WhatsApp contact data, hoover up internet browsing records and track and hack phones. There were so many interception devices at work in the space that delegates’ phones weren’t functioning properly. “I can only get 2G reception,” one of the trainers complained, referencing the downgrading of mobile signal that often accompanies attempts to grab personal data from a device. Others preferred to just leave their phones at home. Slogans around the room promised the prevention of “past and future crimes”, a safer world, and the ultimate triumph of truth and justice. Intellexa, one of the event’s sponsors, shared a thronged back room with rivals like Rayzone, Septier, Cleartrail and NSO.
A leaked business proposal — dated shortly after the Prague fair — outlined the capabilities of Dilian’s new flagship product. Predator was expanded and rebranded as the Nova Remote Intelligence and Analytics Solution. The system comprised “a fully functional standalone cyber intelligence platform with social engineering tools.” This is industry jargon for tools which fool people into clicking on malicious links, thinking they come from friends or other trusted sources. It offered “one-click infection via multiple attack vectors”, licenced for 10 targets at once, with a “magazine of 100 successful infections”. The price tag, including “remote data extraction”, project management and 12 months warranty, was $8 million.
Intellexa was clocking up air miles in the search for customers. In the months leading up to Prague, the white Cessna set off from Greece and Cyprus to visit Dubai, Abu Dhabi and Riyadh. Confidential documentation seen by Lighthouse Reports and partners shows that the company was also pushing hard for deals in Africa, and had engaged a network of known arms dealers to offer its products across the continent. As well as Sudan, the target client list included Mozambique, Angola, Kenya and Equatorial Guinea.
Inside the EU, governments are supposed to regulate any sales of surveillance technology to other countries. But authorities in Greece and Cyprus, when approached for this investigation, refused to disclose whether Intellexa or its associated companies have either applied for, or received, the requisite legal paperwork to actually carry out any non-EU sales.
The most recent set of published accounts for Thalestris, Intellexa’s Irish holding company, declared $35.6m of sales, over three quarters of which were in the Middle East. But two sources with knowledge of the company’s finances said that it had made sales of nearer $200m over the last three years.
While Intellexa’s stock was high at the industry event in Prague its activities on the ground were once again destabilising its host country. Since the revelation of the hacking of the journalist Koukakis in April, the Greek government repeatedly denied any role in or knowledge of the spyware operation. But Greece’s small independent media organisations refused to let go of the story, and its denials were looking increasingly threadbare.

RSF fighters in Darfur: Klaas Van Dijken, Lighthouse Reports
AOJ71H 4 August 2022 15:12 Tel Aviv DOF/220804 C750 -LGKR -LLBG
The arrival of the white Cessna in Tel Aviv was not unusual. Along with Athens and Larnaca, Ben Gurion airport was its most regular stopover. But what happened next was highly unusual, as the jet remained on the ground for 10 weeks. Back in Athens, what was now becoming known as “Greece’s Watergate” was reaching boiling point.
The effort to portray Koukakis as an isolated victim fell apart on July 26 when opposition leader and MEP Nikos Androulakis had his phone checked at the European Parliament as part of a security sweep. The device was found to have received the same infected message as Koukakis. Three days later Greece’s intelligence agency admitted it had also spied on Androulakis, leader of the socialist PASOK party, for a period in 2021, a repeat of the same doubling up of eavesdropping technologies that Koukakis suffered.
Meanwhile, Grigoris Dimitriadis, the prime minister’s nephew, de facto head of his office and overseer of the Greek intelligence agency, had been identified as the government’s connection to the spyware scandal in early June.
Now, as the Cessna sat on the tarmac at Ben Gurion, Reporters United produced evidence of his business links to Felix Bitzios, Dilian’s fixer and the part owner of Intellexa in Greece.
The “tall guy”, as Dimitriadis is referred to in the Greek press, resigned without giving any reason on August 5. The head of Greece’s intelligence agency, Panagiotis Kontoleon, followed suit. The government denied Dimitriadis’ exit had anything to do with Intellexa’s activities and said Kontoleon stepped down owing to failures in legal surveillance activities.
GRIGORIS DIMITRIADIS AND FELIX BITZIOS DID NOT RESPOND TO REQUESTS FOR COMMENT.
The two departures came as a jolt after a series of supine domestic investigations had skirted the core issue of who was operating the Predator hacking software in Greece. The Greek National Transparency Authority, one of three official probes, concluded that there was no contract between the state and Intellexa but did this without looking at Intellexa’s bank accounts. It delayed two months before visiting the company’s offices and failed to meet with any of its legal representatives. Similar shortcomings marked the parliamentary inquiry, led by members of the ruling party, which refused to call key witnesses, and in October cleared the prime minister of any knowledge of the spying affair.
The emerging crisis in Greece also dragged the attention of a European parliamentary committee away from the Pegasus scandal it had been set up to probe. In early September the PEGA inquiry staged a hearing in Brussels on events in Greece where Koukakis gave testimony. In early November its members spent four days in Greece and Cyprus seeking evidence on whether European laws had been broken. A senior Greek government official, who asked not to be named, summed up the contempt in which the mission was held: “We piss on PEGA,” he said.
PEGA’s rapporteur, Sophie in ‘t Veld, described the Greek government denials as “implausible” and asked why there has been no police investigation into Predator. As it stands, “it’s like catching somebody with their lips covered in chocolate and crumbs, claiming that they were never near the cookie jar”. The spyware market, she said, poses a threat to democratic institutions in Europe and around the world. “This stuff is like gangrene. It will infect one part of the body and then spread. You cannot contain it.”
With any strategy to contain the scandal now in tatters and the circumstantial evidence all-but overwhelming the Greek prime minister’s repeated denials, the corrosive effect of powerful spyware technology on even developed democracies is on full show. On November 5 the tabloid newspaper Documento published the first 35 names on what it claims is the full list of the Predator targets in Greece. Every Sunday the roll call is added to and now includes serving cabinet ministers, the inner circle of a powerful shipping and media tycoon, a popular comedian, friends of the prime minister’s wife, senior military figures and the country’s most respected newspaper editor. The list goes on.
While this new Sunday ritual is heavy on sex, lies and blackmail, it provides almost none of the evidence and sourcing that marked earlier independent reporting. So far none of those named have publicly confirmed whether they were infected.
Greece’s government has vowed to impose some form of ban on the sale of spyware but has not moved with any seriousness to close down the spyware operator on its doorstep. The white Cessna has resumed its shuttle runs with brief stops in North Africa and Switzerland. Four thousand kilometres away to the south and east in Sudan’s Jebel Marra, the mountain range that rises above Darfur, sources confirm that the surveillance system, bought from a company headquartered in the EU, is now operational.