For many people, a VPN is accepted as being their best bet for protecting their data and online privacy. While cyber security is certainly a concern for them, most VPN users aren’t exactly adept when it comes to information technology. Like any consumer, they typically err on the side of using a trusted name within the industry. In many ways, ExpressVPN is that standard-bearer. Since it began in 2009, ExpressVPN has signed up millions of users for its service under the promise that it does everything from encrypting data on their internet browser to masking their IP address in order to protect users against hackers and government surveillance.
What most of the 3 million users who currently use ExpressVPN probably weren’t aware of when they signed up is that the service proves the point that hackers and government surveillance aren’t mutually exclusive. On September 13th, ExpressVPN was sold to the Israeli-based company Kape Technologies in a $936 million cash and stock purchase. This acquisition added ExpressVPN to a catalog including several other VPN providers acquired by Kape Technologies since 2017. The acquiring company touted its purchase as being integral to defining the next generation in its fight for online privacy. However, the centralization the VPN services Kape Technologies owns and an examination of its history reveals the company’s efforts to undermine that very cause as a distributor of malware with ties to US and Israeli intelligence operations.
Kape Technologies was founded in 2011 by partners Koby Menachemi and Shmueli Ahdut under the name CrossRider. Early in its origins, CrossRider did not bill itself as a cyber security company. Instead, the focus of the company was on web browsing and advertising technologies. Just 20 months after its founding, the tech start-up with $2 million in working capital was purchased by Israeli tech billionaire Teddy Sagi for $37 million. Menachemi and Ahdut would stay on at the company as its CEO and CTO following the purchase. With the injection of capital that Sagi’s purchase put into the company, CrossRider pivoted its operations to change the scope of its outlook toward cyber security. In 2017, CrossRider cemented that change of direction when it purchased CyberGhost VPN for $10.4 million. Upon its acquisition of the Romanian-based VPN, CrossRider rebranded itself as Kape Technologies.
While CrossRider’s rebrand appeared to be a common tactic by a company marking a shift in its outlook as it made its first foray into cyber security, the basis of the change was rooted in a much different motive. By the time CrossRider had acquired CyberGhost VPN, the adware programs the company designed had been exposed as hacking tools. By attaching its adware to third party downloads, CrossRider was able to install potentially unwanted programs which attached to web browsers as spyware. Microsoft, Symantec MalwareBytes, and other cyber security websites categorized CrossRider’s malware program Crossid as a browser hijacker which collected user information such as browser information to IP addresses in order to monetize data for its value in targeted ad campaigns. With the CrossRider name being attached to this malicious spyware, the company was putting its newest VPN asset in jeopardy. In order to avoid losing users of CyberGhostVPN, rebranding to Kape Technologies was a measure designed to obfuscate the companies history as an entity producing malware programs which were antithetical to the interest of data security. The rebrand proved to effectuate the new image the company sought as it would go on to acquire additional VPN services years before its 2021 purchase of ExpressVPN. In 2018, Kape Technologies acquired Zenmate for $5.5 million and then Private Internet Access for $95 million in 2019.
With its growing portfolio, Kape Technologies had become increasingly more visible. Its umbrella of ownership centralizing multiple VPNs was a red flag for many who placed value in cyber security. Under growing scrutiny, the concerning origins of the company’s founders came to light. It was revealed that Koby Menachemi, Kape Technologies co-founder and former CEO, began his career in information technologies while serving in the Israeli Defense Forces. Menachemi worked as a developer in the Israeli Intelligence Corps under Unit 8200. That division of the IDF was responsible for collecting signal intelligence and data decryption. Its alumni are estimated to have founded over 1,000 tech startups. Companies founded by former operatives of Unit 8200 include Waze, Elbit Systems, and slews of other startups who have since been acquired by the likes of Kodak, PayPal, Facebook, and Microsoft.