# Google Threat Intelligence Group **Entity class:** Organization or company **Domain:** Commercial Intrusion ## Definition Google's threat-intelligence organization provides technical analysis of intrusion activity and vendor ecosystems. The article cites its Intellexa findings to describe adaptation in commercial spyware operations. ## Operational role Commercial intrusion supplies a technical information capability distinct from purchased records and open-source research. Products, customers, contracts, ownership, court decisions, and sanctions form the operating environment of this market. The article connects the tier with commissioned cyber service through the professional instruments governing authorized use. **Architecture connections:** [[wiki/Commercial Spyware|Commercial Spyware]] · [[wiki/Cyber Threat Intelligence|Cyber Threat Intelligence]] · [[wiki/SIGINT|SIGINT]]. ## Relationships - **article-linked source or case:** [[wiki/Intellexa Leaks|Intellexa Leaks]]. - **article-linked mechanism or framework:** [[wiki/Cyber Threat Intelligence|Cyber Threat Intelligence]]. - **collection route:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]]. - **counterterrorism architecture:** [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]]. - **source article:** [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. ## Sources / Provenance - [[articles/The Coming Market for Civilian Spycraft#X. Mercenary Spyware and the Intrusion Tier|The Coming Market for Civilian Spycraft — X. Mercenary Spyware and the Intrusion Tier]] — October 2026 revision; immediate source for this entry’s place in the marketplace. - [Citizen Lab, Spyware Litigation Tracker: Legal Challenges and Formal Complaints Related to Mercenary Spyware.](https://citizenlab.ca/spyware-litigation-tracker-legal-challenges-and-formal-complaints-related-to-mercenary-spyware/) - [Amnesty International Security Lab, Intellexa Leaks: Predator Spyware Operations Exposed (December 2025).](https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/) ## Connected marketplace roles The source article connects this entry with [[wiki/Intellexa Leaks|Intellexa Leaks]]. These routes locate the associated people, implementations, methods, and operational contexts in [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. **Collections:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]].