The Global Spyware Market: Alarming Expansion in 2025 Threat Intelligence Brief

Date: September 20, 2025 (IST) Author :CyberDudeBivash

Executive summary

Despite sanctions, lawsuits, and high-profile exposures, the commercial spyware ecosystem is growing and adapting. New research expands the mapped market to 561 entities across 46 countries (↑ from 435), with 130 new entities added, including 43 created in 2024. Notably, US-based investors surged from 11 to 31, and under-the-radar resellers/brokers are increasingly central to sales and obfuscation. Atlantic Council

Vendors linked to Predator (Intellexa/Cytrox) show renewed activity across more than a dozen countries, even after sanctions and the UK–France Pall Mall Process. Recorded Future+2GOV.UK+2 Meanwhile, platform and legal pushback intensify—Apple shipped major anti-spyware hardening in iOS 26, and Meta won a $167M verdict against NSO—yet governments continue to procure tools (e.g., Paragon’s Graphite for ICE). Net—demand and capital keep the market buoyant. TechRadar+2The Washington Post+2

What’s driving the expansion (2024–2025)

More entities & capital: Atlantic Council’s new dataset maps 561 entities (vendors, investors, suppliers, partners), adding 130 and three new countries; US investors now lead the pack (31). Brokers/resellers increasingly grease cross-border deals and hide provenance. Atlantic Council
Vendor resilience: Predator infrastructure/operators rebounded; first suspected customer noted in Mozambique; footprint remains strong across Africa and beyond. Recorded Future
Policy gaps vs. practice: Diplomatic norms (e.g., Pall Mall code) and EU reforms haven’t yet translated into hard, enforceable limits—leaving space for procurement and investment workarounds. Just Security+1
Active procurement inside democracies: ICE contract for Graphite (Paragon) moved forward this month, underscoring ongoing domestic demand despite earlier reviews and restrictions. The Guardian+1
Platform & legal pushback (not a silver bullet):
- Apple iOS 26 introduces Memory Integrity Enforcement and related defenses specifically targeting mercenary spyware classes. TechRadar
- Courts: Meta vs. NSO verdict ($167M) marks a landmark—but hasn’t halted broader market growth. The Verge+1
- EU’s EMFA takes effect to protect journalists, yet critics warn surveillance carve-outs dilute safeguards. The Record from Recorded Future

2025 snapshot

Intellexa/Predator “resurgent” post-sanctions; new infra patterns, broader hosting ASNs, continued targeting of civil society and officials. Recorded Future
Investment contradictions: US sanctions/visa policies coexist with rising US funding into controversial vendors (e.g., investments in Paragon; Integrity Partners → Candiru). Atlantic Council
Victim landscape keeps widening: Apple threat notifications now routine and global; multi-country warnings point to mercenary targeting as a persistent risk class. Apple Support+1
EU policy flux: New journalist protections via EMFA contrasted by parallel surveillance debates (civil society warns of weakening). The Record from Recorded Future

Risk to organizations & individuals

Who’s at risk: journalists, activists, opposition figures, election stakeholders, diplomats, corporate execs (esp. sectors with geopolitical exposure). Recorded Future
Attack surface: mobile devices (zero/one-click chains), credential theft + cloud backup access, supply through brokers, and cross-border jurisdictional arbitrage. Recorded Future+1

Defensive priorities

Platform hardening now
- Update iOS (26) / Android to latest; enable Lockdown Mode on high-risk users; enforce weekly device reboots on VIPs. TechRadar
High-risk user program
- Maintain a watchlist (journalists, policy, legal, external partners); enroll in Apple/Google advanced protection equivalents; monitor for Apple threat notifications. Apple Support
Egress & DNS controls for C2
- Alert/deny traffic to newly observed Predator T1 infra patterns; block suspicious domain families; require DNS-over-HTTPS logging for mobile fleets. Recorded Future
Procurement & vendor guardrails
- Establish a no-buy list aligned to sanctions/Entity List/visa bans; require transparency on resellers and beneficial ownership before any contract. Atlantic Council
Legal & policy posture
- Align with Pall Mall best practices; publish a human-rights impact assessment for any investigative tech; commit to independent oversight. GOV.UK+1

What to watch next

New investors and shell networks that route capital into sanctioned or Entity-Listed vendors. Atlantic Council
Government deals in democracies that test EO/visa-ban boundaries (e.g., Paragon/Graphite). The Guardian
Platform-level mitigations (Apple/Google) that remove whole exploit classes vs. whack-a-mole patching. TechRadar

Sources & further reading

Atlantic Council Mythical Beasts (2025 update): dataset grows to 561 entities, US-based investors surge; brokers’ role rises. Atlantic Council
Recorded Future (Insikt): Predator remains active; new suspected operator in Mozambique; infra evolution continues. Recorded Future
ICIJ: Intellexa entities appear resurgent despite 2024 US sanctions. ICIJ
Apple: new iOS 26 defenses aimed at mercenary spyware; threat notification guidance. TechRadar+1
Legal/policy: Meta v. NSO verdict; EMFA takes effect; Pall Mall process. The Washington Post+2The Record from Recorded Future+2

#CyberDudeBivash #Spyware #MercenarySpyware #Predator #Pegasus #Intellexa #Paragon #HumanRights #Journalism #EMFA #PallMallProcess #ThreatIntel

Cyberdudebivash