Episode II / Pegasus / Case V of 05
Published: 2026-08-16 · Last reviewed: 2026-08-17 · Evidence current through: 2026-08-17

Episode II — Pegasus, Case V

Sanctioned in 2021. Bought by American investors in 2025. The blacklist remained.

The sanction

In November 2021, the US Commerce Department's Bureau of Industry and Security added NSO Group to the Entity List — alongside Candiru, a fellow Israeli spyware maker. The stated reason was direct: NSO had "developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."BIS

The listing carried real teeth. American companies could no longer sell to NSO without a license, and the review policy was a presumption of denial. For a company whose survival depended on US technology, the measure was designed to be painful.BIS

The second wall: Executive Order 14093

In March 2023, President Biden signed Executive Order 14093, which prohibits US government agencies from the operational use of commercial spyware that poses significant counterintelligence or security risks — or significant risks of improper use by a foreign government. It was a separate mechanism from the Entity List, aimed at a different door. The Entity List governed trade: American companies could not sell to NSO without a license, and licenses were presumptively denied. The executive order governed procurement: the US government itself was barred from operating the tools. Between them, the two policies closed both sides of the American market.FR

The lawsuit that would not go away

NSO was fighting on a second front. In October 2019, WhatsApp and its parent company Meta had sued NSO in a US federal court in California, alleging the company had used WhatsApp's servers to target more than 1,400 users' devices with Pegasus. The case would drag on for years.AI

In December 2024, a judge ruled NSO Group liable for having unlawfully targeted WhatsApp's users and infrastructure. On May 6, 2025, a jury returned a unanimous verdict of $167,698,719 in damages — $444,719 in compensatory damages and $167,254,000 in punitive damages. Amnesty International called the verdict a "momentous win in the fight against spyware abuse."AICT

The headline number did not survive contact with the court. On October 17, 2025, the district court granted WhatsApp's motion for a permanent injunction and remitted the punitive damages to $4,002,471 — a reduction WhatsApp accepted — and final judgment was entered on November 12, 2025, for about $4.4 million. The injunction remained the more important prize: NSO was barred from using WhatsApp as an attack vector. NSO appealed to the Ninth Circuit and moved to stay the injunction; the stay was denied, and the appeal remained pending into 2026.CT

The litigation also produced an uncomfortable fact for the company's own narrative. Legal documents revealed, for the first time, that NSO Group itself — not its government customers — was the entity that "installs and extracts" the data from targeted devices. That does not, by itself, establish that NSO personnel personally reviewed every victim's data. But it left the "we only sell the tool" defense on the record as incomplete: NSO-controlled systems sat inside the technical process.AI

The lobbying push

Sanctions had to be lifted, and that required Washington. NSO Group spent years trying to get off the US blacklist — as recently as May 2025, with the help of a lobbying firm tied to the Trump administration. WIRED documented the shift in detail: new registrations under the Lobbying Disclosure Act, a roster of lobbyists with direct ties to the administration, and an effort aimed at the executive branch that now controlled the Entity List decision. In May 2025, The Washington Post described the push in unusually direct terms: a "rehabilitation tour."WRDWAPO

The tour was not met with a welcome. That same month, The Washington Post reported that the administration rebuffed the effort: officials had no plans to remove NSO from the Entity List, and no plans to rescind the commercial-spyware executive order for the company's benefit. A planned White House meeting was reportedly cancelled once its purpose became clear. The rehabilitation was an active effort. It was not an accomplished fact.WAPO

The lobbying track ran in parallel with a more structural one: changing who owned the company.TC

The ownership shuffle

NSO Group's ownership had never been stable. Founded by Niv Karmi, Shalev Hulio, and Omri Lavie, it was acquired by the US private equity firm Francisco Partners in 2014. Lavie and Hulio took control back in 2019 with help from the European firm Novalpina. In 2021, management of the fund was taken over by Berkeley Research Group. In 2023, Lavie emerged again as majority owner.TC

In October 2025, the cycle turned again. NSO confirmed to TechCrunch that a group of American investors — led, according to Calcalist, by Hollywood producer Robert Simonds — had taken controlling ownership. The deal was valued in the tens of millions of dollars. Calcalist reported that its terms were expected to include the divestment of NSO's roughly $500 million in debt, and that the deal would mark the complete departure of the founding team: Lavie's involvement would end, and co-founder Shalev Hulio had already left the company. American ownership arrived with the Israeli founders out — and, per NSO's own statement, without moving the company out of Israeli regulatory control.TCCAL

The company's spokesperson insisted nothing had really moved: "This investment does not mean that the company is moving out of Israeli regulatory or operational control." Headquarters and core operations, he said, remain in Israel, supervised by the Israeli Ministry of Defense.TC

The new face

A month later, in November 2025, NSO announced an executive chairman: David Friedman, the former US Ambassador to Israel under the Trump administration. NSO filings, as reported by the Times of Israel, stated that "it is reasonably foreseeable that a law enforcement or intelligence agency of the United States will use Pegasus." The appointment was reputational and political positioning — a former ambassador's presence at the top, aimed at Washington. It was not, by itself, US government endorsement, and it changed no US policy.TOI

For researchers who had tracked NSO for years, the acquisition was a warning, not a reset. Citizen Lab's John Scott-Railton, who has documented Pegasus abuse for a decade, put it bluntly: "NSO is a company with a long history of going against American interests and supporting the hacking of American officials. In what world can such a person be trusted to properly oversee a company like NSO Group?"TC

The allegations returned

In June 2026, Meta's WhatsApp said it would ask a US court to hold NSO Group in contempt. WhatsApp alleged that NSO-linked operatives had mounted new targeting attempts — social-engineering messages designed to trick users into clicking malicious links that led off WhatsApp, resembling previously reported NSO-linked phishing campaigns — in violation of the permanent injunction from the case NSO had just lost. WhatsApp said it had also removed test accounts and groups it tied to NSO, and asked the court to hold the company in contempt. The allegation is part of ongoing litigation; a contempt finding, if any, belongs to the court.CL

Citizen Lab's Scott-Railton observed: "NSO Group is behaving just like the dictators they service — treating US courts as something to bypass, and hope that nobody notices." To The New York Times, he added that NSO was "doing an amazing job making the argument that they should stay sanctioned and face more consequences."CL

The state behind the company

In July 2026, OCCRP and partners published records showing that NSO co-founder Shalev Hulio traveled to Panama in December 2013 on an Israeli diplomatic passport, telling Panamanian immigration he would be staying at the Israeli embassy. NSO had sold Pegasus to Panama the year before, with Hulio signing the contract. He denied the finding; the Israeli ministries did not respond.OCCRP

"The separation between the government and NSO is a smokescreen." — Eitay Mack, Israeli lawyer and human rights activist, on NSO's claimed independence from the Israeli stateOCCRP

The diplomatic passport record did not change NSO's ownership. But it added new evidence to a question the rehabilitation tour had carefully avoided: a company that sold spyware to autocratic governments had long claimed it operated independently of its own government. OCCRP framed the record in exactly those terms — it "raises questions" about the firm's claims of independence. Questions, not proof: the record did not by itself establish that NSO was an arm of the Israeli state.OCCRP

Put the pieces together and the strategy is visible. Sanctioned, NSO lobbied. Sued, new targeting allegations followed. Unmasked, NSO found new owners. The ownership changed; the blacklist did not. As of mid-2026, the company remains on the US Entity List, Executive Order 14093 stands, and the permanent injunction is in force — while the contempt motion remains before the court.CLTC

A change in ownership is evidence of restructuring. It is not, by itself, evidence of reform. This is what rehabilitation looks like when it is aimed at the market instead of the behavior.TC