Probe into suspicious share transfers in spyware affair

The anti-money laundering unit (Mokas) is sifting through suspicious transfers of shares in companies registered in Cyprus and linked to the Predator spyware affair, local media reported on Monday.

According to daily Politis, Mokas is investigating various retroactive transfers of shares within a Cyprus-registered company by the name of Santinomo, which at one point owned 35 per cent of the stock in Intellexa – the consortium that develops spyware technology and which was sanctioned by the US Treasury last month.

Sources at Mokas told the daily that once they are done they will forward their findings to the police. It’s understood that Politis itself had dug into the records of the Registrar of Companies and tracked down the retroactive transfers of shares.

A draft report by the European Parliament’s Committee of Inquiry investigating the use of Pegasus and equivalent surveillance spyware, dated November 8, 2022, had identified businessman Felix Bitzios as a key player in companies linked to the Intellexa consortium.

The dossier stated: “Bitzios is connected with Cyprus through his company Santinomo, registered on Cyprus, and his connection with Tal Dilian.”

Dilian is an Israeli ex-intelligence officer and the founder of the Intellexa consortium. The US Treasury describes him as “the architect behind its spyware tools. The consortium is a complex international web of decentralised companies controlled either fully or partially by Dilian, including through Sara Aleksandra Fayssal Hamou.”

The European Parliament report went on: “It seems that Bitzios has been instrumental in the transfer of Intellexa to Greece. Felix Bitzios owned 35 per cent of the shares of Intellexa, through his company Santinomo. However, on August 4, 2022 he registered the transfer of all his shares to Thalestris, the mother company of Intellexa.

Thalestris was among the five corporate entities sanctioned by the US Treasury.

“What is remarkable is not just the date of the registration of the transfer – just days after the revelations of the Androulakis hack – but the fact that the transfer supposedly took place on  December 18, 2020, over 19 months earlier. Bitzios thus retroactively distanced himself from his Intellexa ownership. Nevertheless, Bitzios had been connected to Intellexa from March 2020 to June 2021 as a deputy administrator.”

The European Parliament report explains that Predator spyware “is sold via Intellexa, a consortium of spyware vendors with presence in Cyprus, Greece, Ireland, and France. Tal Dilian, who had a former career in the Israeli Defence Force, set up the consortium in Cyprus. His second ex-wife Polish citizen Sara Hamou is a central figure in the intricate network of companies. Tal Dilian also has acquired Maltese citizenship.”

Back in September 2022, Politis pointed out that the entry changing the ownership in Cyprus-based Santinomo in fact took place on August 4 of that year. This happened just the day before Greek opposition politician Nikos Androulakis was briefed about his phone being hacked by Predator software. The newspaper at the time remarked pointedly whether the timing could plausibly be a coincidence.

Inside Story – a media outlet based in Greece – has for years been pulling on the thread of companies linked to Intellexa and the Predator system. In the autumn of 2022, the outlet produced a shocking reveal. It spoke to two law firms in Nicosia, both of which stated that retroactive changes to company information are not unlawful.

The lawyers said such changes are perfectly regular and legal, but that a company must pay a ‘fine’ to the Registrar of Companies. A request to amend company information is denied only in the event of conflicting data – for instance if the change is signed by a company director whom records show that they resigned prior to signing the document in question.

And according to Politis’ latest findings, on August 31, 2022 an entry was made in the records of Santinomo, where an entity called Finsol Enterprises Limited ceased to be the secretary of Santinomo. But the entry was backdated – it claimed that the change was made in December 19, 2020. The same backdated entry showed that Bitzios resigned as company director of Santinomo. The new director listed was a Swiss national by the name of Andrea Nicola Costantino Hermes Gambazzi.

Then on March 7 of 2024, and only two days after the US Treasury announced the sanctions, there appears another backdated ‘resignation’ by Gambazzi as director of Santinomo. The purported date of resignation is given again as December 19, 2020. With this entry, Bitzios returns as director.

Speaking earlier to Inside Story, Gambazzi said he was unaware of this, and also that he was not acquainted with Bitzios.

In Cyprus, Dilian was connected to the ‘spy van affair’. He was the CEO of WiSpear Systems Limited, a company selling surveillance systems. Charges against Dilian were eventually dropped.

Police here began investigating the case in November 2019, after the ‘spy van’ was showcased in a Forbes report – where Dilian was essentially advertising his services, which included covert surveillance and eavesdropping.