Mercenary Spyware and Exploit Brokers: A Rising Threat in Central Asia

Introduction

The proliferation of mercenary spyware and exploit brokers has introduced a complex and escalating threat landscape in Central Asia. These entities, often operating under the guise of legitimate surveillance vendors, provide sophisticated tools and services that enable cybercriminals to conduct covert surveillance and data exfiltration.

Mercenary Spyware and Exploit Brokers

Mercenary spyware refers to surveillance software developed and sold by private companies to government clients, often without stringent oversight. These tools exploit zero-day vulnerabilities to gain unauthorized access to target devices. Notable examples include NSO Group's Pegasus and Intellexa's Predator. Exploit brokers, on the other hand, specialize in discovering and selling zero-day vulnerabilities to the highest bidder, facilitating the development of such spyware.

Commercial Offensive Tools and Red Team Frameworks

Commercial offensive tools and red team frameworks are utilized by organizations to assess and enhance their cybersecurity posture. However, these same tools can be repurposed by cybercriminals to conduct unauthorized penetration testing and exploit systems. The dual-use nature of these tools underscores the importance of robust security measures to prevent their misuse.

Surveillance-as-a-Service

Surveillance-as-a-Service refers to the outsourcing of surveillance operations to third-party vendors who provide end-to-end solutions, including spyware deployment, data collection, and analysis. This model has gained traction among state and non-state actors seeking to circumvent legal and technical barriers to surveillance.

Threat Actors in Central Asia

Central Asia has become a focal point for the deployment of mercenary spyware. In December 2025, an investigation by Amnesty International's Security Lab revealed that Intellexa's Predator spyware was used to target individuals in Kazakhstan. The spyware was distributed through domains mimicking legitimate Kazakhstani news websites, such as kz-news[.]cc and kz-ordas[.]com, indicating a sophisticated approach to social engineering. (securitylab.amnesty.org)

Additionally, in April 2023, researchers from Citizen Lab reported that QuaDream, an Israeli surveillance firm, targeted at least five members of civil society in Central Asia using a zero-click exploit dubbed ENDOFDAYS. This exploit was delivered via invisible iCloud calendar invitations, highlighting the evolving tactics employed by cybercriminals in the region. (thehackernews.com)

Implications and Recommendations

The activities of mercenary spyware vendors and exploit brokers in Central Asia pose significant risks to individual privacy, national security, and regional stability. The use of sophisticated surveillance tools by cybercriminals underscores the need for enhanced cybersecurity measures, international cooperation, and the development of legal frameworks to regulate the sale and use of such technologies.

Conclusion

The rise of mercenary spyware and exploit brokers represents a formidable challenge in Central Asia's cybersecurity landscape. Addressing this threat requires a multifaceted approach, including technical defenses, policy interventions, and international collaboration to safeguard against unauthorized surveillance and data breaches.