Spyware resellers, exploit brokers, contractors, and partners let both the government and private companies get around spyware restrictions and transparency laws This article explores intermediaries spyware industry. . These middlemen, who are often governments in countries that are okay with it, have helped spyware spread all over the world.
According to a March report from Google's Threat Intelligence Group, more zero-day exploits were linked to commercial surveillance vendors than to traditional state-sponsored groups for the first time in 2025. "Years ago, the spyware market stopped being a way for vendors to sell to governments. Collin Hogue-Spears, senior director of solution management at Black Duck, an application-security company, says, "It has turned into a modular supply chain where intermediaries fill every gap the buyer cannot fill alone."
Julian-Ferdinand Vögele, a main threat researcher at the threat-intelligence company Recorded Future, says, "Their corporate structures exist specifically to make export controls irrelevant." Vögele says that commercial spyware is meant to work in the shadows. Intermediaries use personal connections and networking to get business and keep their business secret.
Roberts from the Atlantic Council says that the Pall Mall Process is still going on. She says that the most important thing that needs to happen soon is for governments to learn more about the spyware market, especially the role of middlemen. Roberts says, "Transparency initiatives are very important for regulating intermediaries and the spyware industry as a whole."
She says, "It's hard to regulate what you can't see," and she adds that it's too soon to judge the results of the Pall Mall process. "It's hard to say which has the biggest effect on spyware today because there is still a lot we can't see," says V Ögele, an analyst at the Berlin-based Centre for Security Policy.
