NSO Group

NSO Group is an Israeli commercial spyware and surveillance technology company best known for Pegasus, a highly sophisticated mobile spyware platform sold to government customers. It is widely tracked as a private sector offensive actor rather than a traditional nation-state intrusion set; Microsoft has mapped it to Night Tsunami. The company is also associated with the name Q Cyber Technologies, and Pegasus is sometimes incorrectly used as an alias for the actor because it is the firm’s flagship capability. NSO Group develops and licenses intrusion and surveillance tooling designed to compromise iOS and Android devices and provide operators with extensive post-compromise access. Documented Pegasus capabilities include collection of messages, emails, photos, files, credentials, cloud-linked data, contacts, call records, and location information, as well as active tasking such as microphone activation, camera activation, and geolocation tracking. Court disclosures and technical investigations indicate that NSO has offered multiple infection vectors over time, including zero-click and one-click delivery through messaging applications, voice and calling features, iMessage, WhatsApp, browser and operating-system attack surfaces, network injection, and other covert delivery methods. NSO Group has been repeatedly linked to advanced mobile exploitation chains, including WhatsApp-based zero-click attacks in 2019 and iMessage-based Pegasus delivery using the FORCEDENTRY exploit chain against Apple devices. Additional Pegasus vectors publicly associated with NSO include exploit families and codenames such as Heaven, Eden, Erised, Hummingbird, KISMET, Diablo, Dragonfly, Megalodon, FINDMYPWN, and PWNYOURHOME. Reporting and litigation records indicate that NSO continued exploit development after public exposure and legal action, and that its tooling architecture supported per-customer operational segregation. Technical reporting on Pegasus infrastructure describes a mature access-as-a-service model with anonymized and segregated infrastructure for each customer, dedicated support functions, and centralized operational monitoring. Publicly disclosed internal materials describe a dedicated White Services function used to provision anonymized infrastructure and accounts for customers, as well as a Pegasus Anonymizing Transmission Network intended to obscure operational ownership. Researchers have assessed that this customer-by-customer segregation can still permit attribution when the same operator artifacts recur across victims. NSO Group states that it sells only to government clients for lawful purposes such as counterterrorism and serious crime investigations. However, the company has been repeatedly and credibly linked to abusive surveillance of civil society, including journalists, human rights defenders, lawyers, dissidents, diplomats, political opposition figures, humanitarian personnel, and government officials. Multiple independent investigations, platform security teams, and court proceedings have tied Pegasus operations to transnational repression and politically motivated surveillance in numerous countries. The company has faced sustained legal and regulatory pressure. WhatsApp sued NSO Group over the 2019 exploitation of its platform to target roughly 1,400 users, and U.S. court proceedings found NSO liable under hacking-related claims, awarded substantial damages, and imposed a permanent injunction barring NSO from targeting WhatsApp and its users. Meta later alleged that NSO violated that injunction through renewed WhatsApp-linked social-engineering and spear-phishing activity. Apple also sued NSO Group over Pegasus attacks against Apple users. The U.S. government placed NSO Group on the Entity List in 2021, citing activity contrary to U.S. foreign policy and national security interests. NSO Group is one of the most prominent examples of the mercenary spyware industry: a commercial vendor that develops high-end offensive cyber capabilities and sells them to state customers. Its operations are characterized by sophisticated mobile exploitation, stealthy surveillance tooling, customer-specific infrastructure, and repeated association with human-rights abuses and unlawful or unethical targeting.