From 1fda357a0390aefb07858c61fd0e8b177f9c7619 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Sun, 30 Jan 2022 11:31:55 +0100
Subject: [PATCH] new: [surveillance] Cytrox added

---
 clusters/surveillance-vendor.json | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/clusters/surveillance-vendor.json b/clusters/surveillance-vendor.json
index d7875c3..e8dc892 100644
--- a/clusters/surveillance-vendor.json
+++ b/clusters/surveillance-vendor.json
@@ -180,7 +180,24 @@
       },
       "uuid": "f49bf1b6-e257-4ffc-b5ac-f0e26ef36965",
       "value": "SpyBubble"
+    },
+    {
+      "description": "Cytrox’s Israeli companies were founded in 2017 as Cytrox EMEA Ltd. and Cytrox Software Ltd. Perhaps taking a page from Candiru’s corporate obfuscation playbook, both of those companies were renamed in 2019 to Balinese Ltd. and Peterbald Ltd., respectively. We also observed one entity in Hungary, Cytrox Holdings Zrt, which was also formed in 2017.",
+      "meta": {
+        "refs": [
+          "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/"
+        ],
+        "synonyms": [
+          "Cytrox EMEA Ltd.",
+          "Cytrox Software Ltd.",
+          "Balinese Ltd.",
+          "Peterbald Ltd.",
+          "Cytrox Holdings Zrt"
+        ]
+      },
+      "uuid": "4dbfa61e-0cf5-4142-babf-3cdce348568d",
+      "value": "Cytrox"
     }
   ],
-  "version": 1
+  "version": 2
 }