Skip to content
Install MCP

Threat actor

Passitora

Last fetched

Passitora is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Passitora, previously known as WiSpear, is a Cyprus-based company controlled by former Israeli intelligence commander Tal Dilian. It sells advanced surveillance technology to governments worldwide. Despite a ban on Israeli intelligence and defense exports to Bangladesh, Passitora sold spyware to the country's National Telecommunication Monitoring Centre (NTMC), a branch of the Interior Ministry responsible for monitoring internet and social media. This technology enables interception of calls, texts, and internet traffic. The company has faced scrutiny in the past, including a scandal in Cyprus involving its SpearHead system, which was used to extract private data from people's phones without their knowledge or consent. Passitora is part of the Intellexa Alliance, a network of companies marketing and selling spyware globally.

Techniques by tactic

No ATT&CK techniques are recorded for Passitora in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Passitora today — this states the absence of a published link, not that Passitora has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Passitora into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.