Exposé reveals Israeli spyware firm’s mysterious Singapore project dating back to 2018

The Israeli-owned cyber-surveillance firms operating in Cyprus were revealed to be deeply involved in global data theft and the distribution of spyware.

An investigation done by the International Consortium of Investigative Journalists (ICIJ), uncovered the roles of Tal Dilian, a former elite Israeli intelligence commander, and his ex-wife Sara Hamou in establishing a network of companies responsible for exporting spyware globally.

Notably, a company registered under Hamou’s name in 2018 signed a services agreement with a Q Cyber Technologies subsidiary for a secretive “Installations project in Singapore.”

Q Cyber Technologies is the parent company of NSO Group, an Israeli firm infamous for its spyware technology, particularly Pegasus.

According to ICIJ, Q Cyber Technologies was created by the merger of Circles and NSO Group. Circles is a company founded by Dilian.

NSO Group has faced extensive international criticism for its involvement in creating and selling surveillance technology.

Profiting from surveillance

According to the ICIJ, Tal Dilian achieved billionaire status through his first spyware venture, Circles.

Notably, this enterprise distributed spyware worldwide, with clients including the Thai military and the United Arab Emirates, reportedly accruing annual sales surpassing US$100 million at its zenith.

Dilian and his associates brokered the sale of Circles for a reported US$130 million to a U.S. private equity firm in 2014, securing Dilian over US$20 million from the transaction.

A consortium of seven companies retained a 12% share in the enterprise, which eventually merged with Israel’s NSO Group, and rebranded as Q Cyber Technologies.

This stake appreciated significantly when Q Cyber Technologies was later sold in a 2019 deal, valuing the corporation at approximately US$1 billion.

Dilian’s innovative use of Cyprus as a nerve center for his cyber-surveillance endeavours paved the way for numerous analogous firms to proliferate across the island.

Leaked documents cited by ICIJ demonstrated Sara Hamou, Dilian’s wife, facilitating the relocation of several Israeli executives linked to Dilian to Cyprus.

In November 2018, Hamou expedited the registration of a new company in Cyprus, Maravilhas Solutions Ltd., “specializing in vehicle enhancements” but engaged in providing telecommunication services as well.

Maravilhas symbolizes Cyprus’ role in bolstering Israeli-owned cyber-surveillance companies in disseminating spyware globally.

Shortly after its establishment, Maravilhas inked a service agreement with a Q Cyber Technologies subsidiary.

Hamou’s pivotal position was evident as she concurrently served as a director in both entities. The agreement outlined Maravilhas’ provision of hardware, installation services, and ongoing support to Q Cyber Technologies.

Soon after Maravilhas was incorporated, it signed a services agreement with a subsidiary of Q Cyber Technologies.

Maravilhas swiftly invoiced the Q Cyber Technologies subsidiary, notably billing US$40,800 for specialist technicians and logistics for an “Installations project in Singapore.”

Further invoices totalling over US$100,000 were sent for another project in the UAE, though the specifics of these undertakings remain undisclosed in the leaked documents.

No additional details are available in the leaked documents regarding the specific nature of Maravilhas’ operations in the UAE and Singapore, as reported by ICIJ.

“Both countries have checkered human rights records but have strong ties with Israel’s defence and intelligence industries, ” it added.

Dilian sheltered amid Intellexa’s spyware scandal

Despite the prior exposure of Intellexa’s spyware scandal, Dilian skillfully avoided significant repercussions, largely attributing his success to the concerted efforts of his ex-wife, Hamou.

The Cyprus Confidential documents unearthed a pivotal transaction where Hamou assumed ownership of a company valued at over US$2 million from Dilian in the recent past.

Furthermore, these confidential records unveiled Hamou’s orchestration of an extensive corporate network geared towards the development and sale of spyware.

This far-reaching network reportedly extends its reach across Europe, spanning regions from North Macedonia to Hungary, Greece, and Ireland.

In October, Amnesty International highlighted Intellexa’s sale of Predator spyware, capable of turning phones into surveillance devices.

This spyware enables access to stored or transmitted data like messages, calls, photos, and microphones.

Amnesty’s Predator Files report revealed Intellexa’s sales to countries including Switzerland, Austria, Germany, Congo, Jordan, Kenya, Oman, Pakistan, Qatar, Singapore, the UAE, and Vietnam.

Between February and June 2023, at least 50 accounts – 27 belonging to individuals and 23 to institutions – were publicly targeted via X (formerly Twitter) and Facebook.

Dr Collin Koh Swee Lean, a senior fellow at the S. Rajaratnam School of International Studies (RSIS) Institute of Defence and Strategic Studies, was among a string of academics targeted between February and June.

Citizen Lab’s report in April revealed the utilization of spyware and hacking tools developed by Israeli company QuaDream against minority-party politicians and journalists in multiple nations, including Singapore.

Founded by a former Israeli military official and NSO Group veterans, QuaDream’s spyware, including Pegasus, has been extensively used worldwide for surveillance purposes.

At least five people have reportedly been targeted by QuaDream spyware, Pegasus, and exploits in North America, Central Asia, Southeast Asia, Europe, and the Middle East.

Citizen Lab has identified servers in 10 countries that received data from victims’ devices, including Israel, Singapore, Mexico, the United Arab Emirates and Bulgaria.

It also noted that QuaDream has marketed its spyware and services to government clients including Singapore, Saudi Arabia, Mexico, Ghana, Indonesia, and Morocco.

In Citizen Lab’s report, it highlighted that Singapore’s constitution does not recognize the right to privacy, and state authorities have broad surveillance powers that bypass standard judicial mechanisms.

A 2018 Citizen Lab analysis found suspected Pegasus spyware infections in 45 countries, including Singapore.

In February 2022, Singapore’s Minister of State for Home Affairs, Desmond Tan declined to discuss whether the government uses QuaDream’s spyware or other spyware technologies, citing the need to safeguard national security.

In that same parliamentary session, Minister for Home Affairs and Law, K Shanmugam, responded to a question raised by WP MP, Ms Sylvia Lim regarding a threat warning she received from Apple regarding the potential hacking of her phone by state-sponsored agencies.

The Minister said he had confirmed that Ms Lim’s phone has not been hacked by Singapore’s state agencies in the time between when the question was raised and the present moment, after having checked with the Security and Intelligence Division (SID), which falls under the Ministry of Home Affairs (MHA).