هذا التقرير متاح أيضًا بـ العربية
Over the past several years, North Macedonia has become a prominent hub for the electronic espionage industry linked to Israel. Technology companies based in the country have helped develop surveillance tools that have spread beyond its borders, triggering political and security scandals and international judicial investigations. Their activities have brought scrutiny of this small Western Balkan state’s role in a highly sensitive security industry.
The companies’ history reveals an intricate network of investors, businessmen and intelligence experts whose activities spanned several countries. They drew on commercial and technological ties to develop products for security and government agencies. Their activities have raised questions about oversight by the Macedonian authorities, their links to official institutions and the extent of responsibility for the use of technology developed in the country.
The issue has broader significance amid growing ties between Skopje and Tel Aviv. Three decades of diplomatic and economic cooperation have developed into partnerships in military affairs and cybersecurity, despite the controversy surrounding Israeli spyware companies operating in the country and what their activities reveal about the intersection of political, security and commercial interests.
Noon Post is publishing this report as part of its “Israeli Corridor in the Balkans” series, which traces Tel Aviv’s expansion in the Western Balkans through weapons, technology, money, energy, tourism and political relations. The series examines how these sectors are becoming a network of influence linking Israel to countries in the region. This report explores the development of relations with North Macedonia, the espionage industry networks that emerged there, the people behind them and what became of them.
From diplomacy to espionage: How did the Israeli presence expand?
Israel and Macedonia established diplomatic relations on 7 December 1995, four years after the latter’s independence from Yugoslavia. At the time, Macedonia was embroiled in a dispute with Greece over its name. Greece objected because the name was associated with a northern region of its own territory and with the legacy of Alexander the Great, king of ancient Macedonia in the fourth century BC. It feared the name could encourage territorial claims to Greek land.
The country joined the United Nations in 1993 under the provisional name “the former Yugoslav Republic of Macedonia”. Relations with Israel were established under that designation, although Israel later recognised the constitutional name “Republic of Macedonia”. The Prespa Agreement with Greece ended the dispute in 2018 and entered into force in February 2019, when the country became known as North Macedonia.
Relations developed through trade, investment, agriculture and health, alongside cooperation in commemorating Macedonian Jews exterminated by the Nazis. On 9 December 2015, then-Macedonian Prime Minister Nikola Gruevski met his Israeli counterpart, Benjamin Netanyahu, in occupied Jerusalem.
The two sides signed a declaration of friendship and two agreements covering the avoidance of double taxation and the encouragement and protection of investments. Netanyahu identified energy, water, technology, agriculture and counterterrorism as areas in which to expand the partnership.
Defence cooperation attracted greater attention after Prime Minister Hristijan Mickoski’s government came to power in June 2024. In November that year, Macedonian Defence Minister Vlado Misajlovski discussed strengthening military ties with the then non-resident Israeli ambassador, Simona Frankel.
To maintain the momentum in relations, North Macedonia abstained in September 2025 on a UN General Assembly resolution endorsing the “New York Declaration” on the establishment of a Palestinian state and the implementation of the two-state solution. The resolution was backed by 142 countries and opposed by 10, with 12 abstentions.
In January 2026, a Macedonian parliamentary delegation led by lawmaker Rashela Mizrahi, chair of the parliamentary friendship group with Israel, visited the Knesset and met Speaker Amir Ohana and other officials. Tel Aviv praised Skopje’s supportive positions in international forums.
Relations reached a new milestone on 24 August 2026, when North Macedonia’s Minister of Foreign Affairs and Foreign Trade, Timcho Mucunski, visited Israel and met his counterpart, Gideon Sa’ar.
The two sides signed a cooperation programme covering education, science, culture, youth and sport for 2026–29, along with a memorandum of understanding on economic consultations. They also discussed opportunities to expand cooperation in defence industries, cybersecurity, agriculture, water management and investment.
In an interview with the English-language newspaper The Jerusalem Post on 25 August 2026, Mucunski said strengthening relations with Israel had become one of his government’s foreign policy priorities. He also spoke about making North Macedonia a gateway to European markets for Israeli companies. Sa’ar praised Skopje’s political positions, particularly since 7 October 2023.
Marco Brelits, a researcher at the International Crisis Group, links Balkan states’ differing positions towards Israel to each country’s calculations and domestic interests. Florian Bieber, professor of Southeast European history and politics at the University of Graz in Austria, believes domestic politics and national narratives play a central role in shaping these relations.
In North Macedonia, journalist and political analyst Slobodanka Jovanovska asked on 26 August 2026 what the country expected to gain from treating Israel as a strategic partner, and what moving closer to it during the assault on Gaza would cost. She raised these questions particularly in light of North Macedonia’s limited defence spending and reliance on NATO.
The opposition Levica party also criticised the expansion of military and technical cooperation, while Mucunski presented it as an opportunity to attract investment and strengthen security.
The security technology sector returned to the forefront of bilateral talks in 2026. Nine years earlier, Cytrox had been established in Skopje, specialising in surveillance and cyberespionage software. It later developed the Predator phone-hacking programme.
According to an investigation published on 12 April 2023 by North Macedonia’s Investigative Reporting Lab, IRL, and the Greek website Inside Story, Cytrox was founded in March 2017 with the participation of five Israeli investors: Dror Harpaz, Sharon Adler, Avraham Rubinstein, Eyal Abraham Oren and Alon Arabov.
Also involved was Rotem Farkash, who was listed as Hungarian in the incorporation record, grew up in Tel Aviv and had previously served in the occupation army. North Macedonian businessman Ivo Malinkovski managed the company.
It was registered as Cytrox with nominal capital of 25,000 euros. Changes to its legal form and ownership eventually established a direct link with the Hungarian company Cytrox Holdings in 2020. Malinkovski belongs to a family that owns Miki International, which trades in weapons, ammunition and security equipment, as well as a winery and the Chateau Kamnik restaurant.
An investigation published by the Balkan Investigative Reporting Network at the end of 2021 revealed that Macedonian security institutions were among the family company’s clients. Washington had blacklisted the company in 2009 before removing it months later. The report cited sources who said Ilija Malinkovski, Ivo’s father, had taken part in early investment talks. Ilija denied any role in founding Cytrox or negotiating with its financiers.
On 27 June 2017, state-owned Israel Aerospace Industries announced a multimillion-dollar investment through its cybersecurity division in Hungary’s Cytrox and the Netherlands-based NexPedia. It described Cytrox’s business as developing intelligence solutions for governments to collect information from devices and cloud services.
A Haaretz investigation published in late June 2023 also revealed that the Israeli company had bought an initial stake of about 31 per cent in Hungary’s Cytrox. About a year and a half later, it sold the stake to a company registered in the British Virgin Islands that was subsequently linked to the Intellexa network. It continued its investment in NexPedia, which was itself linked to the Macedonian company Cyber Lab.
Company records reviewed for the investigation show that Rotem Farkash and Avraham Rubinstein helped found NexPedia in the Netherlands, Cytrox in Hungary and its Macedonian subsidiary. These connections linked the early Israeli investment to the development centre that emerged in Skopje.
Israeli businessman Meir Shamir appeared among the beneficiaries of Macedonia’s Cytrox from April 2021. His group was linked to an earlier investment of about $3.5 million for a 32 per cent stake in Aliada Group, a company registered in the British Virgin Islands that later became part of the financing and ownership network.
In 2018, Tal Dilian, a former Israeli military intelligence officer and former commander of the technical Unit 81, became involved in the project through his business ties to Cyprus-based WiSpear, which specialises in intercepting communications.
Forbes magazine revealed in August 2019 that Dilian had acquired the Macedonian company Cytrox for less than $5 million after it came close to collapse. He incorporated it into Intellexa, the network he founded to develop and market spyware systems.
The network extended to Greece, Cyprus, Hungary and Ireland, with development, marketing, ownership rights and distribution operations spread across those countries. Since 2019, it has also been linked to technical and commercial cooperation with France’s Nexa Group, which works on communications interception systems. Within Macedonia, four companies linked to the same group of shareholders and directors emerged: Cy Shark, Cygnet, Cytellexa and Cyber Lab.
The Cy Shark network included Ivo Malinkovski and Moshe Farkash, Rotem’s father. Working with Cytrox, the company submitted applications to the Interior Ministry to manufacture and export surveillance tools. Cygnet and Cytellexa appeared within the same circle of shareholders. Cyber Lab was linked to the Dutch company Invidio, with Avraham Rubinstein and Rotem Farkash among those benefiting from its ownership.
Shahak Shalev, a former technical official in Israeli military intelligence, worked at Cyber Lab. He lived in Macedonia between 2017 and 2022 and oversaw development work.
A former employee told journalists that the Skopje and Athens teams operated as part of a single system and that Macedonian employees helped train staff in Greece. This reinforced the evidence of the Skopje centre’s role in developing the programme.
Cytrox recorded revenues of about 1.5 million euros in 2020, followed by no operating revenue in 2021 or 2022, according to documents reviewed by Radio Free Europe in July 2023. During this period, companies in the network were offering surveillance systems worth millions of euros.
Cisco’s Talos security research unit also documented a commercial offer worth about 13.6 million euros. It included the capacity to hack 20 devices simultaneously, alongside management, control and technical support services.
On 5 March 2024, the US Treasury Department identified the main companies’ roles. It confirmed that Hungary’s Cytrox Holdings developed Predator before production moved to North Macedonia’s Cytrox, which took over its development within Intellexa. Companies in Greece and Ireland managed marketing, assets and distribution rights.
The exposure of the network coincided with management changes in Skopje. Malinkovski left the company’s management in October 2022, and women from other countries were subsequently listed as directors. One was a retired Czech woman who said in February 2024 that she had been surprised to find herself listed as the company’s director. Sylwia Jastrzębska, a Polish woman, later appeared in management records.
Jastrzębska’s name resurfaced in connection with European companies linked to people in the Intellexa network in an investigation published by the International Consortium of Investigative Journalists in August 2025.
Under the authorities’ watch: How did the spyware companies operate in Skopje?
In 2015, North Macedonia was rocked by a wiretapping scandal involving about 20,000 people, including politicians, journalists and businesspeople, during the rule of former Prime Minister Nikola Gruevski. Reforms to the intelligence services and oversight mechanisms followed.
Against this backdrop, Cytrox and Cy Shark submitted two applications to the Interior Ministry on 6 October 2017 to manufacture, sell, import and export communications interception tools. The applications described prospective clients in government, intelligence and police agencies. Ivo Malinkovski signed on behalf of both companies.
An investigation by IRL and Inside Story revealed that both applications lacked basic technical specifications. The Interior Ministry requested the missing information, and Malinkovski submitted additional documents on 7 November 2017.
Technical experts consulted for the investigation said the specifications matched the characteristics of the technology that later became Predator. This linked the early licensing applications to the product that sparked international espionage scandals.
In a response sent to journalists on 15 December 2022, the Interior Ministry’s then-spokesman, Toni Angelovski, confirmed that it had neither licensed the two companies to manufacture spyware nor purchased the technology from them.
The investigation cited employees at the relevant agencies who said they had struggled to assess the technology in question because of a lack of specialist expertise and officials’ reluctance to address the case.
In April 2023, Svetlana Nikoloska, a professor of criminal investigation at North Macedonia’s St. Kliment Ohridski University, said indications that work was being carried out outside the licensing terms warranted intervention by the Interior Ministry and the public prosecutor, as well as an examination of whether laws governing surveillance and software had been violated.
Oversight bodies revisited the case in 2022 following parliamentary discussions and a training session attended by lawmakers. The session was organised by the Geneva Centre for Security Sector Governance, an international institution specialising in strengthening oversight of security agencies.
Pavle Trajanov, North Macedonia’s former interior minister and then a lawmaker, said the ministry had informed parliament that it was examining the circumstances surrounding Predator’s development. He also said former National Security Agency chief Viktor Dimovski had acknowledged that the agency possessed advanced surveillance capabilities, without specifying whether these were connected to the programme.
In July 2023, North Macedonia’s intelligence service confirmed that it was aware of Cytrox but declined to disclose “classified details,” while the public prosecutor said it had seen no indication that producing the programme alone constituted a criminal offence. Questions remained over the licensing applications and investigations into the companies’ activities.
The case has added significance given repeated European criticism of the effectiveness of judicial and institutional oversight in North Macedonia. The European Commission’s rule of law report, issued in July 2025, highlighted challenges concerning judicial independence and the effectiveness of anti-corruption efforts. European legal studies also examined the difficulties spyware poses for traditional rules governing communications interception.
The investors’ ties to political officials also emerged in photographs and meetings bringing the Malinkovski family together with former North Macedonian Prime Minister Zoran Zaev and then-Serbian President Aleksandar Vucic at Chateau Kamnik.
In an investigation published on 13 July 2023, IRL and Inside Story revealed that Tal Dilian, the former Israeli military intelligence officer, had met Zaev in 2018 before acquiring Cytrox. Citing a source in Skopje, they also reported that NATO had previously advised the authorities against cooperating with the company.
The contacts extended to circles around the region’s intelligence services. In March 2022, the Greek intelligence service and North Macedonia’s Operational Technical Agency, which handles the technical implementation of authorised communications interception, drafted a framework for cooperation on cybersecurity and information-sharing.
Following a meeting in Thessaloniki between then-Greek intelligence chief Panagiotis Kontoleon and Macedonian agency director Zoran Angelovski, it emerged that an examination of the draft’s electronic record showed edits by Nir Ben Moshe, former head of Malmab, the Israeli Defence Ministry’s security unit, and a figure linked to the Intellexa circle.
The Macedonian agency confirmed that the talks had taken place but said the agreement had not been signed and no classified information had been exchanged under it. The investigations also revealed that Greek companies trading in defence equipment had arranged accommodation and office space for network officials.
In the second half of 2020, Rotem Farkash, one of Cytrox’s founders, moved to Athens. Kestrel, a company linked to Greek defence equipment trader Stavros Komnoupolos, covered his living expenses. Ravnar, another company tied to the group, provided guarantees for the lease of Intellexa’s offices in the Elliniko area.
On 5 April 2026, journalist Vassilis Lambropoulos reported in the Greek newspaper To Vima on documents showing that Intellexa had joined a consortium of 11 companies in 2021. The consortium sought nearly 3 million euros in European funding for a technology project involving the Center for Security Studies, which is affiliated with Greece’s Ministry of Citizen Protection.
The project included the development of systems for data analysis, artificial intelligence and risk forecasting. Rotem Farkash and Mirom Harpaz, a senior Intellexa official, took part in its meetings. The consortium also signed a cooperation agreement with a technical centre affiliated with Greek intelligence. The project subsequently stalled, and the proposed funding was not disbursed.
In an assessment of the industry on 5 October 2023, Amnesty International Secretary-General Agnès Callamard said the “Predator Files” investigation had exposed the vast scale of the trade in highly intrusive surveillance tools amid failures in European export controls and accountability. She warned of their use against journalists and dissidents.
These warnings place the Cytrox case within the broader question of whether authorities can regulate an industry whose development, ownership and marketing span several countries. Macedonian investigations into licensing and corporate responsibility produced limited results, even as the case led to US sanctions and proceedings in the Greek courts.
From Skopje to the world: How far has Predator spread, and who has held its makers accountable?
On 16 December 2021, Citizen Lab, the digital surveillance research centre at the University of Toronto in Canada, revealed that the phone of Egyptian opposition figure Ayman Nour, who lives in Türkiye, had been infected simultaneously with Predator and Pegasus, the spyware developed by Israel’s NSO Group. It also documented the infection of another Egyptian journalist’s phone.
Its analyses showed that the programme could collect messages and data, track location and activate sensitive functions on the phone. Researchers also identified indicators of potential operators in countries including Egypt, Greece, Serbia, Saudi Arabia and Oman.
That same day, US company Meta, which owns Facebook and Instagram, announced that it had removed about 300 accounts linked to Cytrox that were being used to lure targets to malicious links.
In 2022, a spying scandal erupted in Greece after confirmation that financial journalist Thanasis Koukakis’s phone had been hacked and that an attempt had been made to target Nikos Androulakis, leader of the opposition PASOK party.
The case led to the resignations of intelligence chief Panagiotis Kontoleon and Grigoris Dimitriadis, secretary-general of the prime minister’s office. They came amid accusations that official surveillance overlapped with the targeting of some of the same individuals using commercial spyware, an issue that remained the subject of political and judicial dispute.
In October 2023, the “Predator Files” investigation, coordinated by the European Investigative Collaborations network with the participation of media organisations and Amnesty International, revealed that Intellexa alliance products had spread to at least 25 countries. The investigations compiled deal and marketing documents, operational indicators and hacking attempts, with the nature of the evidence varying between countries.
Among the most prominent cases were a deal to supply hacking technologies to Vietnam’s Ministry of Public Security and attempts to target international political figures. The investigation “Flight of the Predator”, published by investigative outlet Lighthouse Reports and its partners in November 2022, documented the transfer of a surveillance system linked to Dilian’s network to Sudan’s Rapid Support Forces militia.
On 22 September 2023, Citizen Lab confirmed that Egyptian politician Ahmed Tantawi had been targeted after announcing his intention to run for president. His internet browsing was intercepted and he was redirected to malicious infrastructure. The lab suggested that the Egyptian government was likely responsible.
The lab also identified likely operational infrastructure in Serbia and an attempt to target Albanian politician Etilda Gjonaj, the former justice minister, with the spyware through a reply to one of her posts in June 2023.
In February 2026, Amnesty International documented that Angolan journalist Teixeira Cândido’s phone had been infected with the software in May 2024. Other investigations revealed an attempt to target a human rights lawyer in Pakistan’s Balochistan region in the summer of 2025, confirming that the network’s tools remained in use after US restrictions began.
Leaks analysed by Amnesty International on 4 December 2025 showed the development of “Aladdin” technology, which exploits digital advertising to deliver hacking tools to phones. Recordings also revealed that Intellexa employees could remotely access some government clients’ systems.
Yuri van Bergen, a technical researcher at the organisation’s Security Lab, said this access raised questions about responsibility for operations and targeted individuals’ data, particularly given the company’s technical ability to view sensitive parts of clients’ surveillance systems.
On 3 December 2025, Google’s Threat Intelligence Group announced that the network was linked to the exploitation of 15 zero-day vulnerabilities among the cases it had documented since 2021. It said the network had continued developing intrusion methods despite sanctions.
An investigation by Recorded Future, which specialises in cyber threat intelligence, also revealed shipments of equipment and software linked to Intellexa network companies to Kazakhstan in October 2023. Worth about $12.4 million, the shipments were routed through Polus to the Kazakh company Seven Hills.
The shipments included data analysis systems and technical equipment, although the investigation did not specify the value of the portion tied to Predator itself. It also documented the continued presence of operational infrastructure linked to the programme in several countries during 2025.
US sanctions began on 18 July 2023, when the Commerce Department’s Bureau of Industry and Security added North Macedonia’s Cytrox, its affiliated Hungarian company and two Intellexa entities in Greece and Ireland to its export restrictions list.
On 5 March 2024, the US Treasury Department imposed financial sanctions on Tal Dilian and his former partner, Sara Hamu, who managed companies linked to the network. It also sanctioned five entities, including North Macedonia’s Cytrox.
The sanctions were expanded in September to target, among others, Felix Bitzios, a former Intellexa director and shareholder; Mirom Harpaz, one of its senior officials; and Andrea Gambatze, the beneficiary of companies linked to the programme’s distribution rights. Aliada was also targeted; the Treasury said it had facilitated financial transactions worth tens of millions of dollars.
On 30 December 2025, Washington removed Hamu, Harpaz and Gambatze from the financial sanctions list. The decision drew objections in the US Senate amid technical reports that the network’s activities had continued after sanctions were imposed.
On 26 February 2026, a misdemeanour court in Athens convicted Dilian, Hamu, Bitzios and Giannis Lavranos, owner of Greek security company Krikel, on charges relating to breaches of communications secrecy and unlawful access to information systems and personal data.
Each defendant received a total sentence of 126 years, with a maximum of eight years to be served. The sentences were stayed pending appeal. Additional findings were referred to prosecutors for examination of more serious charges, including espionage. Requests for further investigation also covered other people linked to the network, including Rotem Farkash, one of the founders of North Macedonia’s Cytrox, and Mirom Harpaz.
In July 2026, eight Predator victims filed civil lawsuits, each seeking 1 million euros in compensation. The dispute over Greek state agencies’ responsibility continued after prosecutors refused to reopen aspects of the investigation despite objections from the victims’ lawyers.
A report by the Parliamentary Assembly of the Council of Europe on 10 September 2026 indicated that about one-third of those targeted by the spyware were also under surveillance by Greek intelligence. The relationship between government bodies and private companies remained in dispute.
Rebecca White, a researcher at Amnesty International’s Security Lab, described the February rulings as a step towards holding the spyware industry accountable. The need to establish responsibility and compensate victims remained.
In North Macedonia, the Official Gazette published a notice on 31 December 2024 announcing the start of preliminary proceedings before the Skopje court to examine whether the conditions for Cytrox’s bankruptcy had been met. A bankruptcy trustee was assigned to examine its assets and liabilities.
Cy Shark underwent bankruptcy-related legal proceedings in 2023 and 2024. The North Macedonian commercial database Company Wall records Cytrox as having been struck off on 26 August 2025.
The North Macedonian company that helped develop Predator thus ended up in bankruptcy and dissolution proceedings after the spyware’s operations spread across multiple countries and led to US sanctions and convictions in Greece. The international network, meanwhile, continued developing new tools.
In Skopje, questions remained unanswered about accountability for the 2017 licence applications and the fate of the companies’ assets and software rights. In August 2026, the government moved to expand defence and cyber cooperation with Israel, extending a political and economic relationship that began three decades earlier and in which security technology has become one of the main areas of cooperation.