Treasury Cleared Three Intellexa Names Before a Greek Conviction

The U.S. Treasury removed three Intellexa executives from its sanctions list on December 30, 2025, after they petitioned and said they had left the consortium. The deletions were Sara Aleksandra Fayssal Hamou, Andrea Nicola Costantino Hermes Gambazzi, and Merom Harpaz.

A U.S. official said the facts that produced the listings no longer applied. Fifty-eight days later, a Greek court convicted Hamou with Intellexa founder Tal Dilian, who was not in the deletion notice. Researchers at Recorded Future’s Insikt Group kept mapping Predator servers after both events.

Treasury Struck Three Names From the Cyber List

OFAC’s daily notice for that Tuesday mixed Iran and Venezuela designations with a short set of removals. Buried in the cyber entries, the office deleted three names from the SDN List under the CYBER2 program. The Federal Register later recorded the same unblocking as FR Doc. 2025-24251, with an action date of December 30, 2025.

Hamou, listed with the aliases Sara Hamou and Sara Hamou-Hemsi, had a Limassol address, Polish nationality, and a date of birth of June 27, 1984. Gambazzi was listed with addresses in the United Arab Emirates and Frome in the United Kingdom, Swiss nationality, and a Lugano place of birth. Harpaz was listed in Elliniko, Greece, as an Israeli national with Romanian nationality as well.

Treasury told inquirers the move followed “the normal administrative process in response to a petition request for reconsideration,” and that each person had “demonstrated measures to separate themselves from the Intellexa Consortium.” The public notice itself carried no dossier of those measures.

The original listings had been personal. In a March 5, 2024 action, Treasury named Dilian as founder and Hamou as a corporate off-shoring specialist who rented office space in Greece for Intellexa S.A. and held leadership roles at Intellexa S.A., Intellexa Limited, and Thalestris Limited. That package also listed those three firms plus Cytrox AD and Cytrox Holdings ZRT, and said the network’s tools had been used against Americans, including U.S. government officials, journalists, and policy experts.

On September 16, 2024, Treasury added five more people and one company. It described Harpaz as a top executive who had managed Intellexa S.A., and Gambazzi as beneficial owner of Thalestris Limited and Intellexa Limited, with Thalestris holding Predator distribution rights and sitting as parent of Intellexa S.A. Those two waves produced seven named people. The December notice took three of them off and left the other four, plus Aliada Group Inc. and the March companies, untouched in that document.

The Off-Ramp Was Written Into the Sanctions Manual

OFAC’s own removal page tells listed people they may file a petition for administrative reconsideration under 31 CFR 501.807. The test is whether the basis for the listing was too thin, or whether the circumstances that produced it no longer exist. A grant leads to a Federal Register notice. A denial can be followed only with new arguments or evidence.

The same language appears in the September 2024 Intellexa package: the point of a listing, Treasury wrote then, is a change in conduct, and the office will take names off when the law requires it. An official used that frame again on the December deletions.

Each individual has demonstrated measures to separate themselves from the Intellexa Consortium and it has been determined that the circumstances resulting in the sanction no longer apply. The power of sanctions derive not only from the ability to designate individuals, but also from our willingness to remove sanctions consistent with the law.

U.S. official, comment on the Intellexa deletions

Natalia Krapiva, senior tech legal counsel at Access Now, asked for the file the public never saw. “The public deserves to know what evidence exists to clearly demonstrate that these individuals have ceased their involvement with the Intellexa-affiliated entities that have been targeting US officials, both Republicans and Democrats, with spyware,” she said.

A U.S. blocking order and a foreign criminal case are different machines. OFAC was deciding whether American persons still had to freeze property. It was not sitting as a trial court on Greece’s 2022 wiretapping scandal. That gap is what the December notice opened, and what Athens then filled.

Athens Then Convicted Sara Hamou Anyway

On February 26, 2026, Judge Nikos Askianakis of the Second Single-Member Misdemeanor Court of Athens found Dilian, Hamou, Felix Bitzios, and Yiannis Lavranos guilty after 39 hearings. The charges included breaching the confidentiality of telephone communications, interfering with a personal-data filing system, and unlawful access to an information system.

The court treated completed intercepts of journalist Thanasis Koukakis and Artemis Seaford, plus three people who clicked bait links, together with 82 attempted intercepts. Those counts add to 87 victim cases. Prosecutor Dimitris Pavlidis argued the acts should be punished as separate offenses because they hit different people. The bench followed him and refused mitigating circumstances.

Each defendant received an aggregated term of 126 years and eight months. Under the misdemeanor cap, eight years are to be served. Execution was suspended pending appeal, so the four stayed free. Pavlidis said the Predator installation remained stored in Greece and asked for further files, including a look at possible espionage charges. The judge sent the record on for five new probes.

Hamou had been off the American list for 58 days when that verdict landed. Dilian, still listed in Washington, said in an email that the ruling was “fundamentally irreconcilable with the evidentiary record” and that he would not be “a scapegoat.” He later said he had stayed silent at trial and would take the case to national, regional, and international bodies, including a request to the U.N. special rapporteur on judicial independence.

John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, called it the first time an executive at a mercenary spy company had been convicted and sentenced to prison. “What this shows is when all the facts of spyware companies’ business models get in front of a fair judge, consequences will follow,” he said.

How Did the U.S. and Greek Tracks Diverge?

Washington built a financial cage around people and firms. Athens tried a local deployment. The dates do not line up as a single policy.

THE TWO TRACKS AFTER THE 2024 LISTINGS

1. July 18, 2023: The Commerce Department adds Intellexa S.A., Intellexa Limited, Cytrox AD, and Cytrox Holdings ZRT to the Entity List over cyber-exploit trafficking.
2. March 5, 2024: OFAC lists Dilian, Hamou, and five companies, calling the consortium a web of firms that commercialized invasive spyware under the Predator brand.
3. September 16, 2024: OFAC lists Bitzios, Gambazzi, Harpaz, Panagiota Karaoli, Artemis Artemiou, and Aliada Group Inc., a British Virgin Islands firm Treasury said Dilian directed and that moved tens of millions of dollars.
4. December 30, 2025: OFAC unblocks Hamou, Gambazzi, and Harpaz after petitions. Dilian, Bitzios, Karaoli, Artemiou, Aliada, and the March companies are absent from that deletion notice.
5. February 13, 2026: Five Senate Democrats ask Treasury Secretary Scott Bessent and Secretary of State Marco Rubio for a briefing by February 27 on the deletions.
6. February 26, 2026: The Athens court convicts Dilian, Hamou, Bitzios, and Lavranos on the Greek Predator deployment, with eight years to serve and the sentence stayed on appeal.

The Entity List additions were an export-control step, not an SDN listing, and the December notice did not mention them. State had also announced a visa-restriction policy on commercial spyware misuse and said it had used that policy on thirteen people. Those tools sit beside OFAC, and none of them was a verdict on the 87 Greek cases.

Four Intellexa Names Remain on the SDN List

The December action was a person-by-person edit. It did not publish a finding that Intellexa had dissolved, that Predator had been retired, or that the March companies were clean.

INTELLEXA PEOPLE IN THE 2024 PACKAGES

Treasury had described Bitzios as beneficial owner of a consortium company used to supply Predator to a foreign government client, and as a manager of Intellexa S.A. Karaoli was listed as a director of multiple firms under Thalestris. Artemiou was listed as general manager and a board member of Cytrox Holdings, and as an Intellexa S.A. employee. Dilian remained the named founder. Aliada Group Inc. was the September company, not a person, and it was not in the deletion notice either.

Gambazzi’s listing had tied him to the holding and distribution layer. Taking his name off the SDN List did not, in that notice, take Thalestris or Intellexa Limited off with him. Banks still have to screen the firms that stayed designated, and they still have to decide what a “separated” former owner means for those shares.

Predator Traffic Did Not Follow Them Out

Insikt Group wrote that public exposure and U.S. listings were followed by a visible drop in Predator activity, then by a return. Operators changed host networks, leaned on fake 404 pages and dummy login screens, and moved away from domains that impersonated local news sites. Newer hostnames often used two random English words, and a few used Portuguese, matching language in southern Africa.

The same report was the first to flag new Predator infrastructure including Mozambique. Insikt said more than half of identified Predator customers were in Africa. A Mozambique-linked cluster remained active through at least late June 2025. Servers assessed as serving customers in Saudi Arabia, Kazakhstan, Angola, and Mongolia were still talking to high-tier infrastructure. Insikt also assessed, with medium confidence, an Iraq customer still operational in 2025.

CLUSTERS INSIKT STILL TIED TO CUSTOMERS

• Mozambique: Newly named customer; the linked cluster ran through at least late June 2025.
• Saudi Arabia, Kazakhstan, Angola, Mongolia: Customer-side servers still seen communicating with high-tier Predator infrastructure.
• Iraq: Medium-confidence customer assessment, still treated as active in 2025.
• Older map: Prior Insikt work had already placed suspected operators in Angola, Armenia, Botswana, the Democratic Republic of the Congo, Egypt, Indonesia, Kazakhstan, Mongolia, Oman, the Philippines, Saudi Arabia, and Trinidad and Tobago.

That persistence sat beside other pressure that was supposed to raise the cost of the trade, including an E.U. resolution, a U.S. visa-restriction policy, and the British- and French-led Pall Mall Process against commercial spyware. Insikt’s conclusion was narrower than a shutdown claim: the tool adapted, and demand held, especially where export rules bite.

Amnesty International’s Security Lab, working from leaked material, said Intellexa staff could view victim data on some customer systems, including logs of who was being watched. In a separate forensic case, Amnesty found Predator on the phone of Angolan journalist Teixeira Cândido after a May 2024 WhatsApp approach, an infection dated after the first OFAC wave. “It feels like you’re walking naked and being watched,” Cândido said. Amnesty also reported a summer 2025 Predator hit on a human-rights lawyer in Pakistan.

Predator has been in the field since at least 2019. It is sold as a one-click or zero-click implant that can open a phone’s camera, microphone, messages, and files. Treasury’s own September 2024 notice stressed that a successful attack needs no tap from the target. The December deletions did not include a line about disabling that product.

Warren and Shaheen Asked for a Briefing

On February 13, 2026, Senators Elizabeth Warren of Massachusetts and Jeanne Shaheen of New Hampshire led a letter to Bessent and Rubio, joined by Andy Kim of New Jersey, Adam Schiff of California, and Michael Bennet of Colorado. They asked for a briefing by February 27 on why three of the seven listed people had been taken off, and what the administration planned to do about commercial spyware aimed at Americans and at dissidents abroad.

The letter called Intellexa a “web of entities” whose Predator tool had been used to “covertly surveil U.S. government officials including members of Congress, journalists, and policy experts, and to repress people in other countries who speak out against threats to their freedom.” It said staff had already sought a briefing, did not get one, and then watched the December 30 deletions. It described the three as an offshoring specialist with leadership roles, the true owner of the firm holding Predator distribution rights, and a top executive of the consortium.

The senators tied that request to 2023 legislation they said had told the executive branch, on a bipartisan vote, to fight the spread and misuse of foreign commercial spyware. Treasury and State had no immediate public reply attached to the letter. Whether the February 27 date produced a closed-door briefing has not been published in the materials reviewed for this account.

Hamou can hold a Greek conviction and an American unblocking at the same time because the two systems asked different questions. OFAC asked whether U.S. persons still had to block her property. The Athens court asked whether she took part in a local surveillance rollout that hit 87 cases. Dilian remains the named founder on the 2024 U.S. packages. Predator’s later servers, in Insikt’s telling, did not clock out when three biographies did.