Skip to content
Install MCP

Threat actor

Avnon Group

Last fetched

Avnon Group is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Avnon Group is an Israeli firm that develops and distributes surveillance technologies through various subsidiaries, such as Bler and Tactic Lab. It's founded by Tomer Avnon, a former Israeli Navy SEAL. The company offers various tools for intelligence and law enforcement, like IMSI catchers and Wi-Fi sniffing equipment, to enable real-time mobile tracking and wireless communication interception. According to its official website, it operates in over 80 countries worldwide. Avnon has established partnerships with various countries in the SWANA region, including Morocco and several Gulf nations. The company also has a significant relationship with Egypt, where its subsidiary Bler sold its monitoring tools, specifically its Webint Center platform, to Egypt's Technical Research Department through intermediaries. Avnon sold social media-tracking software to Hungary, allowing the government to monitor online discourse and public opinion. The sale was approved by Israel's Defense Ministry. Related to Avnon Group is Synaptech Capital, the first Israeli-Emirati venture capital fund to invest in Israeli and Emirati startups - including ones that develop and distribute surveillance technologies. Synaptech Capital was co-founded by Tomer Avnon and Obediah Ayton, COO of The Private Investment Group.

Techniques by tactic

No ATT&CK techniques are recorded for Avnon Group in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Avnon Group today — this states the absence of a published link, not that Avnon Group has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Avnon Group into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.