Surveillance Tools Open Database
Mercenary spyware, mobile forensics, network surveillance. Documented vendors, sourced victims, traceable sanctions. No speculation, no advocacy, no affiliation.
Where the industry is based
Vendor concentration. Israel hosts eleven of the 35 tracked tools. The United States, Western Europe and China account for most of the remainder. Hover any marker for details.
Why this database exists
Citizen Lab publishes individual forensic reports. Amnesty Security Lab tracks specific vendors. Forbidden Stories led the Pegasus Project. Each effort is essential, but no single resource maps the commercial surveillance industry as a whole, with consistent confidence scoring and cross-vendor comparison.
This database is that resource. Every entry is sourced to court documents, Treasury sanctions, peer-reviewed forensic research, or multi-source investigative reporting. Every claim that cannot be verified through these channels is explicitly marked. Predaxia takes no position on national security policy. The mission is documentation, not advocacy.
Tier S, Mercenary spyware and mobile forensics
Pegasus
NSO Group · Israel
Mercenary spyware deployed by 14+ governments against journalists, activists and dissidents. Zero-click iOS and Android exploitation.
Predator
Intellexa Consortium · North Macedonia / Israel
Mercenary spyware run by a sanctioned web of shell companies. Used against journalists, MEPs, US lawmakers and human rights defenders.
Cellebrite UFED
Cellebrite DI · Israel
Mobile forensics suite used by 2,800+ US government agencies. Capabilities documented through 2024 leaks and Marines contract disclosure.
Paragon Graphite
Paragon Solutions · Israel / US
Spyware focused on encrypted messaging apps. WhatsApp notified ~90 targets in 2025. Italian prosecutors confirmed forensic infection of journalists.
QuaDream / Reign
QuaDream Ltd · Israel
iOS zero-click spyware (ENDOFDAYS exploit) using invisible iCloud calendar invites. Operators identified in 10 countries before company shutdown.
Candiru / DevilsTongue
Candiru Ltd · Israel
Windows spyware capable of decrypting Signal messages and stealing browser data. Used in CatalanGate, Hungary TISZA party, and 100+ documented victims.
Hermit
RCS Lab / Cy4Gate · Italy
Modular Android and iOS spyware deployed in Kazakhstan and Italy. Disclosed by Google TAG and Lookout. Distributed with help from victim ISPs.
FinSpy / FinFisher
Gamma Group · UK / Germany
Long-running surveillance suite. Customers included Egypt, Bahrain, Bangladesh, Ethiopia, Saudi Arabia. Company filed insolvency in 2022 after German prosecution.
Heliconia
Variston IT · Spain
Browser exploitation framework targeting Chrome, Firefox and Defender. Disclosed by Google TAG. Company shutting down in 2024.
Operation Triangulation
Unattributed · Disclosed by Kaspersky
iOS zero-click chain (CVE-2023-32434, CVE-2023-32435, CVE-2023-38606) deployed against Kaspersky Lab employees. One of the most sophisticated iOS attacks ever publicly documented.
Memento Labs
Memento Labs (ex-Hacking Team) · Italy
Italian mercenary spyware vendor (RCS Galileo, Da Vinci). 2015 internal leak exposed contracts with Sudan, Ethiopia, Saudi Arabia, UAE, Mexico and others. Rebranded 2019 after InTheCyber acquisition.
DarkMatter / Project Raven
DarkMatter Group · United Arab Emirates
UAE state-aligned cyber operation exposed by Reuters in January 2019. Karma iOS zero-click used against Ahmed Mansoor, Rori Donaghy and US citizens. DOJ deferred prosecution agreement 2021.
Toka
Toka Cyber · Israel
Israeli IoT-exploitation vendor founded by former PM Ehud Barak and ex-IDF Cyber Command head Yaron Rosen. Smart cameras, connected vehicles, smart home. Forbes investigations 2021-2022.
Tier A, Mobile forensics and network surveillance
GrayKey
Magnet Forensics · United States
Mobile passcode-bypass appliance used by US federal agencies and Five Eyes partners. Acquired by Magnet Forensics in March 2024.
MSAB XRY
Micro Systemation AB · Sweden
Mobile forensics suite documented in Belarus, Bangladesh and Myanmar deployments. Voluntary export suspensions since 2021.
Magnet AXIOM
Magnet Forensics · Canada
Computer, mobile and cloud forensics platform. Taken private by Thoma Bravo in 2023. Acquired Grayshift in March 2024.
Oxygen Forensic Detective
Oxygen Forensics · United States
Mobile and cloud forensics with strong social-media and IoT acquisition. Russian origin, US headquartered since 2015.
ElcomSoft
ElcomSoft Co. Ltd. · Russia
Long-standing Russian password-recovery and forensics vendor. Subject to the Sklyarov v. United States DMCA case in 2001.
Sandvine PacketLogic
Sandvine · United States
Carrier-grade Deep Packet Inspection platform used by Egyptian operators to inject Predator spyware. Added to US Entity List February 2024.
Cognyte
Cognyte Software · Israel
Communications-intelligence and OSINT platform spun off from Verint in 2021. Named in the Meta Surveillance-for-Hire report.
Amesys / Eagle
Amesys / Nexa Technologies · France
French mass-surveillance vendor. Sold the Eagle system to Libya (2007-2011) and Cerebro to Egypt. Executives indicted in 2021.
Tier B, Facial recognition and biometrics
Clearview AI
Clearview AI · United States
Public-web face search engine indexing 30 billion images. BIPA settlement (May 2022) plus multi-million fines in UK, France, Italy, Greece, Australia.
Hikvision
Hangzhou Hikvision · China
World’s largest video-surveillance vendor. Documented Xinjiang deployment with ethnic-detection algorithms. US Entity List 2019, FCC ban 2022.
Dahua Technology
Zhejiang Dahua · China
Second-largest video-surveillance vendor. Xinjiang Public Security Bureau contracts. Uyghur Alarm feature disclosed by IPVM 2020.
NEC NeoFace
NEC Corporation · Japan
Top-ranked NIST FRVT algorithm. Deployed by Met Police LFR, South Wales Police (Bridges ruling), Argentina (suspended), Indian state forces.
Idemia
Idemia · France
Multinational biometrics from Safran-Oberthur merger. National ID issuance, border eGates, TSA PreCheck. Government-identity scale.
PimEyes
Face Recognition Solutions · Poland (opaque)
Consumer-accessible face search engine. Documented use in stalking, deanonymization, and sextortion ecosystems. Multiple EU DPA investigations.
Tier C, Signals interception and IMSI
L3Harris StingRay
L3Harris Technologies · United States
Cell-site simulator family (StingRay, Hailstorm, KingFish). Used by 75+ US federal, state and local agencies per ACLU FOIA disclosures.
Rayzone Piranha
Rayzone Group · Israel
IMSI catcher and SS7 geolocation toolset. Bangladesh, Indonesia, Mexico documented customers. Forbes 2020 InterApp disclosure.
Tier D, Predictive analytics and OSINT
Palantir Gotham
Palantir Technologies · United States
Data-integration platform for intelligence and law-enforcement. ICE FALCON, US Army TITAN, UK NHS FDP. LAPD predictive policing terminated 2020.
Voyager Labs
Voyager Labs · Israel
Social-media OSINT analytics. NYPD secret contract disclosed by Brennan and NYCLU 2021. Meta lawsuit filed January 2023 (CFAA, fake accounts).
Cobwebs Technologies
Cobwebs (PenLink) · Israel
Israeli OSINT and social-media monitoring vendor. ICE, NYPD, FBI customers per Brennan and NYCLU. Named in Meta Surveillance-for-Hire report 2021. Acquired by PenLink January 2023.
Babel Street (Locate X)
Babel Street · United States
US commercial mobile-location intelligence vendor. DHS, IRS, ICE, US Marines customers without warrants per Wall Street Journal. ACLU and EFF litigation ongoing.
Maltego
Maltego (ex-Paterva) · South Africa / Germany
Graph-based OSINT platform founded in Pretoria 2007 by Roelof Temmingh. Dual-use: heavy presence in investigative journalism (Bellingcat, OCCRP, ICIJ) and government forensics.
ShotSpotter / SoundThinking
SoundThinking · United States
Acoustic surveillance via city-mounted sensor arrays. MacArthur Justice Center 2021: 89% false-positive rate in Chicago. Adam Toledo case 2021. Atlanta, Chicago and Charlotte terminated contracts.
Confidence Score methodology
Each entry receives a 1 to 5 score reflecting the strength of public documentation behind it. The score is a measure of evidence, not severity.
- 5/5Government or judicial sources, plus Citizen Lab or Amnesty Security Lab forensic confirmation, plus multi-source investigative reporting.
- 4/5Citizen Lab or Amnesty Security Lab confirmation plus two or more independent press sources.
- 3/5One reference source supplemented by press reporting.
- 2/5Press-only documentation, multi-source convergent.
- 1/5Single press leak, unverified attribution, contested claims.
Contribute or correct
Predaxia Research welcomes corrections, new sources, and additions. Contributions are reviewed against the same evidentiary standards as the existing entries.
Submit a correctionView methodology