How a Czech Supply Chain Feeds the Global Spyware Machine

Guangzhou had a bank account in Nicosia, Cyprus, which received transfers from a Zurich account. Hamou’s Cypriot consultancy firm, Censura Ltd, resided at the same address as Guangzhou’s Cyprus address.

Guangzhou appears to have been highly profitable. Guangzhou’s stock portfolio assessment from EFG Bank in Zurich, seen in Hamou’s correspondence with her accountant, showed the company to be holding a portfolio of stocks valued by the bank at approx. $800,000 as of June 30, 2019, showing that the company appears to have invested an atypical proportion of its profits in stocks.

Documents seen by Investigace.cz also provide a snapshot of Guangzhou Commerce’s business activity. From the transactions in 2018-19, large payments exist for “affiliate commissions,” including one for nearly $400,000 dollars from a Gibraltar-based affiliate marketing company, whilst Guangzhou paid Revcontent LLC, an affiliate ad-tech company that distributes and promotes ad content across a network of partner websites, including clickbait “chumboxes,” regular fees of $50,000 to $60,000.

Guangzhou Commerce Limited entered voluntary liquidation in January 2021 and was officially dissolved on April 28, 2022. The directors and owner never changed.

An invoice from Censura Ltd dated February 4, 2019 marked a package destined to Krnov—to one of Hazan’s Czech companies. Another invoice from “Dvir Horef Hazan The Magic Maker” charged Censura Ltd for travel costs of €422 euros on July 11, 2019.

Investigace.cz contacted Hamou for comment on her business relationship with Dvir but received no response.

Deliveries From Krnov to Greek Intellexa

Hazan bought his first company in Krnov in 2017 together with Itai Hamami. They registered the company at Hazan’s home. Later, two other Israelis with intelligence and defense links would become 30 percent shareholders of the company.

Based on Hazan’s social media, he and Hamami are friends, not just business partners. Hamami presents himself as a programmer and developer. When we tried to talk to him he replied that he’s a very private person and would like to stay that way. 

Most of Hazan’s companies, however, reside or resided at a different address: a large orange house owned by the company H.S.Three Holding, where Hazan used to own a small share up until May 2025.

When the reporters of investigace.cz went to visit Krnov on March 19, 2025 in search of Hazan, the headquarters was unmistakable, situated on a main road with a plethora of advertising banners for various local internet and business telecomm unications-related services. An enormous Israeli flag draped over the building’s facade gave the address the appearance of an embassy.

The Israeli flag was Hazan’s initiative, explained a short, middle-aged lady, working in one of the offices inside the building. According to her, he placed it there around the time of Israel’s incursion into Gaza following Hamas’s attack in early October 2023.

Parts of the building and surrounding area had clearly been affected by the great floods, which devastated Krnov in the autumn of 2024. A man working on the building claimed to know Hazan. But he didn’t know where he was, he said, adding that he wouldn’t discuss the companies. On the mailbox was a list of companies, some of them Hazan’s, some belonging to his associates, some unrelated. 

Through three of these companies, Hazan has been working for Greek Intellexa for years: Zambrano Trade s.r.o., Hadastech s.r.o. and Shilo s.r.o., founded in 2019, 2020 and 2021. 

The documents we have obtained show that Hazan initially billed the Greek Intellexa S.A $53,000, for “used lab equipment” on November 19 2020. The supply of equipment we have seen accounts for a total of nearly half a million euros.

Between 2020 and 2022, the invoices and shipping documents are for unspecified “services according to our agreement,” but also more particular equipment: special wireless modems and mobile routers for remote network access, programmable radio transceivers probably allowing wireless interception, storage servers for data retention, and rack-mounted servers for data processing. 

Dvir also provided high-end laptop computers, network switches for routing traffic, sensors for weather monitoring, and power distribution units and backup power systems for maintaining uptime.

Luca Melette, a security consultant and telecommunications expert consulted by Investigace.cz, said that a series of the devices purchased is compatible with building a radio transmitter or interceptor. 

Based on a review of Intellexa’s surveillance products and documentation, Melette assessed the equipment list in Hazan’s of invoices and stated “the wifi access points would be compatible with malware delivery over wifi,” “the USRPs [a type of radio included in the list] with GSM antennas are compatible with creating a fake 2G/3G/4G/5G base station as well as for IMSI catching and baseband malware delivery.” 

An IMSI-catcher is a surveillance device that simulates a cell phone tower, enticing nearby mobile devices to connect to it and thereby reveal their IMSI (International Mobile Subscriber Identity) numbers. The laptops could be “needed to operate the devices in a portable setup” and “servers could be used to control backends, data storage and key cracking services.” Melette suggested that “they could [be used to] build some static infrastructure…the rack, servers, ups, monitors and laptops connected to the SDRs [“software defined radio”] in a mobile setting, connecting back to the LTE modems.”

Investigace.cz also consulted Amnesty Tech’s Jurre van Bergen about the equipment list. Van Bergen also noted that the radios “can be used to program and emulate radio waves or can be used to emulate cell-towers…to act as an IMSI-catcher, or test IMSI-catcher spyware injection with.” 

A 2019 Forbes interview with Tal Dillian shows him demonstrating such equipment from the back of his van to reporters whilst promoting Intellexa in Larnaca, Cyprus.

One invoice dated July 28, 2022 for Dvir’s company lists “Payment for project POC, ‘Aladin.'” According to Haaretz, in 2022 Intellexa presented a proof of concept for a system called Aladdin that enables the remote infection of a specific mobile telephone device through online advertisements. The system was supposedly capable of so-called “zero-click” attacks: with a browser open, the infection happens without the need to click on the fake ad itself.  

Hazan even acted as a middleman when Intellexa needed stalls for conferences, including the Prague ISS World conference in 2022, the biggest spy conference in Europe. “I always wondered what he does for a living,” said one of the stall-builders from the company that resided in the same compound as Hazan’s companies.

One of Hazan’s companies appears to have recently become his residential address. A site visit unexpectedly resulted in Investigace.cz’s reporter conversing with Hazan via a doorbell camera. Hazan immediately recognized the reporter he was talking to and threatened  to call the police, and then threatened to physically attack them. “You can record that,” he stated.

The Czech Spyware Network’s Collaborators

In the batch of documents investigace.cz has acquired is a shipping declaration from December 2020, the contents of the delivery being “18 palettes of computer parts.” The procurement was made by Czech company Hadastech, owned by Dvir Horef Hazan, an Israeli living in Krnov, a small Silesian town. The destination of this shipment was Greece; the receiver, Intellexa SA. The supplier was an Israeli company called Amos Levy Consultant Ltd, or just Amos Levi Ltd (both spellings are included on different sheets). 

Amos Levy is an Israeli entrepreneur. He also owns three companies in the Czech Republic, the service descriptions in the Czech registry include “rental and management of real estate.” He also owns a property in Portugal, and is the founder of a famous fetish nightclub in Tel Aviv, which he ran for almost twenty years after a career in the army. He runs a small network of interconnected companies in Portugal, of which one of his firms, Tamani s.r.o, is also listed as a shareholder. These companies don’t have websites, but are listed as “computer consultancy” in the business register. 

When we first called Amos Levy a few months ago, he sounded confused. He didn’t remember a shipment from five years ago. He then texted: “2020 is too far away, covid time,” and added he’s retired and will let us know if he remembers anything. He refused to speak to us when we contacted him again.    

All of Levy’s Czech companies have one thing in common: he either co-owned them with, or bought them from, Amos Uzan or Uzan’s wife.

As investigace.cz previously described, Amos Uzan is an Israeli entrepreneur living in the Czech Republic. According to his LinkedIn profile, he worked for the Israeli government between 2003 and 2009. This included a “security” role for the office of the Prime Minister of Israel between 2003 and 2006, followed by a role as a “spokesperson” for the Knesset from January 2008 until April 2009. Between 2006 and 2009 the prime minister was Ehud Olmert, who later admitted consulting for Intellexa. 

In 2009, Uzan moved to Prague and worked in the Israeli Embassy of the Czech Republic before identifying a business opportunity setting up an investment firm for Israelis in real estate known as Conbiz s.r.o, short for “consulting business”. 

Uzan’s mother-in-law was the director of one of the Intellexa companies, Cytrox, between 2022 and 2023. When confronted with this, she declared she had no idea about it. 

When we tried to contact Levy again a couple months later, he told us to leave him alone. Amos Uzan didn’t reply to our questions.

Two more Israelis have appeared in Dvir’s company history whilst servicing Intellexa: since April 2023, Sean Farhi of Tel Aviv and Esliasaf Grinfeld of Elkana appear as beneficial owners with a 30 percent share of Dvir’s central business BENDER ONE s.r.o, which remains open. Grinfeld writes that he has been working in the intelligence industry according to Linkedin.

Predator Spyware Still Being Used in 2025

Recorded Future’s Insikt Group this month released a cybersecurity report indicating that Intellexa’s Predator is still active, with newly identified infrastructure connected to Predator operators. They uncovered “continued use of Predator” including in Mozambique, still active since the first half of 2024. 

Insikt Group identified the use of fake websites used to deploy Predator, including “fake 404 error pages, counterfeit login or registration pages, sites indicating they are under construction” and websites purporting to be associated with a conference. The researchers indicate that one set of servers used for Predator infrastructure is associated with FoxItech s.r.o, a Czech company operated by Michal Ikonomidis of Krnov, previously reported on by Investigace.cz as an affiliate of Dvir Horef Hazan. Those servers “play a central, though still unclear, role in Predator-related operations.” 

Over the past two years, Insikt Group has identified suspected Predator operators in more than a dozen countries, including in Angola, Armenia, Botswana, the Democratic Republic of the Congo, Egypt, Indonesia, Kazakhstan, Mongolia, Mozambique, Oman, the Philippines, Saudi Arabia, and Trinidad and Tobago.

Intellexa on Trial

Meanwhile, the Intellexa trial in Greece started in April of this year. The Athens’s prosecution accused four people: Tal Dillian, Sara Hamou, the beneficial owner of Intellexa, and the owner of a Greek company, which purchased Predator. The four defendants face misdemeanor charges for unlawfully accessing private communication systems and data, as well as for violating privacy and data protection laws, specifically for spying on a Greek journalist Thanasis Koukakis and a woman who worked for social media company Meta.    

The trial is currently on hold because the court failed to translate key documents to English (they are only in Greek, which the defendants don’t speak). 

Journalist Thanasis Koukakis, a victim of the Predator spyware, told us “whilst the prosecutorial investigation yielded certain findings, it did not pursue the matter to its conclusion.” He warned that while “the trial is set to resume in the autumn”, “there is a serious risk that the offenses in question may be rendered statute-barred,” meaning that delays to the trial could mean a legal claim can no longer be brought because the statute of limitations could expire.

Zambrano Trade s.r.o., Hadastech s.r.o. and Shilo s.r.o. were liquidated on November 1, 2024, a month after investigace.cz published the first article about Hazan’s involvement with Intellexa.