Q Cyber Technologies Ltd: NSO Group's Israeli parent and its owners

analysisQ Cyber Technologies Ltd is the Israeli company that has held NSO Group Technologies' shares since March 2014 and was recorded in NSO's 2019 annual report as its corporate director from 19 March 2014; it is distinct from the Luxembourg Q Cyber Technologies S.à r.l. OSY Technologies of Luxembourg has owned all of its shares since 17 March 2014; the companies above OSY changed in 2014, 2019, February 2023 and October–December 2025, when the register shows NorthPole Newco passing from Lavie's Dufresne Holding to Schremer, to Hippocrene Ventures and back to Schremer, while the investors NSO spoke of are not named in any retained document. Q Cyber is a co-defendant with NSO in WhatsApp's California suit, in which the punitive award was remitted to $4,002,471 and a permanent injunction entered before the defendants appealed, and in July 2026 an Israeli court held that its payments to OSY were taxable dividends. ^{1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40}

analysisQ Cyber Technologies Ltd is a private Israeli company, number 514971522. It was incorporated on 2 December 2013 as L.E.G.D. Company Ltd, and on 29 May 2016 the Israeli Registrar of Companies certified its change of name to Q Cyber Technologies Ltd. NSO Group Technologies Ltd, registered as N.S.O. Group Technologies Ltd under number 514395409, had been incorporated on 25 January 2010. In their annual reports to the Registrar updated to 7 January 2019 both companies gave the same address, 22 Galgalei Haplada, Herzliya. Copies of the register published by two Israeli company-information sites, read instead of the register itself, list Q Cyber as an active private company formed to engage in any lawful business, with a last annual report for 2025, and give it and NSO the same address in each copy: Yael Man 1, Ramat HaSharon in one and HaAluf Yitzhak Hofi 1, Ramat HaSharon in the other. Neither copy records when the address changed, and a shared address does not show which company occupies the premises. ^{1 2 3 4 5}

analysisUntil at least June 2019, according to the WhatsApp complaint, NSO Group's website described NSO as "a Q Cyber Technologies company"; the archived page filed as an exhibit reads "NSO Group, a Q Cyber Technologies company". In 2021 correspondence with the authors of an NGO research report, NSO Group gave its own description of the two companies' functions: NSO Group Technologies and Q Cyber Technologies develop, market and export Pegasus and related analytical products for governmental use and provide sales, marketing and administrative support and oversight to their affiliates. Israeli business reporting said in January 2023 that the difference between Q Cyber and NSO might be purely symbolic and in March 2023 that Q Cyber was in every respect identical to NSO, with NSO's chief executive Yaron Shohat also its chief executive; no register record of Q Cyber's officers after 2019 was retained, and press reports of January 2026 say Shohat stepped down after the 2025 change of ownership. US courts have treated the two companies together: the Ninth Circuit's opinion of 8 November 2021 and the Northern District of California's orders of 8 March 2024 and 30 September 2026 refer to them jointly as "NSO", and the Eastern District of Virginia's memorandum of 26 October 2023 describes NSO Group as a subsidiary of Q Cyber. ^{1 6 7 8 9 10 11 12 13 14}

analysisAccording to Israeli register records cited in the 2021 NGO report, which were not themselves retained, Q Cyber has since 2019 been the sole shareholder of two further Israeli companies, NGTP Ltd (number 516043551, incorporated 20 June 2019) and S. Sesame Technology Ltd (number 516080850, incorporated 5 September 2019). NSO Group told the authors that both were inactive and had been created for potential future plans that had not materialised. Copies of the register, which do not show shareholders or officers, list both as active private companies with annual reports filed for 2025; NGTP's registered address is HaAluf Yitzhak Hofi 1, Ramat HaSharon, the address shown for Q Cyber and NSO in the same source, and S. Sesame Technology's is in Neve Daniel. ^{7 15 16}

analysisQ Cyber's own annual report, updated to 7 January 2019 and signed on 16 June 2019, lists OSY Technologies S.à r.l. of Luxembourg (B184226) as its sole shareholder with all 100,000 ordinary shares and as its director from 17 March 2014. According to the Israeli tax judgment of July 2026, Q Cyber's shares passed to OSY on 17 March 2014, 70% of NSO's shares were transferred from OSY to Q Cyber under a trust agreement on 19 March 2014, and the remaining 30% were exchanged for shares in Triangle Holdings on 30 November 2014. NSO's report of the same date as Q Cyber's lists two shareholders: Q Cyber, with 118,263 ordinary, 8,936 ordinary A and 295,170 preferred A shares, and NSO itself, with 67,453 ordinary shares. Above OSY the chain has changed with each owner. According to the 2021 NGO report and an aggregator summary of the Luxembourg register, from November 2014 Square 2 owned OSY and was in turn owned by Triangle Holdings, whose sole shareholder at first was OSY Holdings, which Francisco Partners described in 2021 as a Cayman Islands vehicle wholly owned by its fund Francisco Partners III, through which the fund held an indirect controlling interest in NSO from March 2014 to 18 March 2019. After the 2019 buyout, Mercury Public Affairs' registration of December 2019 under the US Foreign Agents Registration Act described Q Cyber as wholly owned by OSY, which Square 2 held through intermediate companies, with Square 2 about 32% owned by Triangle and about 68% by NorthPole Holdco, a vehicle of the fund then called Novalpina Capital Partners I SCSp. ^{1 2 3 4 5 6}

analysisAn aggregator's summary of the Luxembourg register records that NorthPole Newco replaced Square 2 as OSY's shareholder on 6 May 2019, after the buyout. Israeli business reporting on 1 March 2023, based on a notice filed in Q Cyber's Tel Aviv proceedings and on the Luxembourg register, said that the lenders that had financed the 2019 buyout had exercised their rights under the loan agreements, so that the pledged shares of NorthPole, until then held by a holding company called Diamond, passed to Dufresne Holding, whose sole shareholder and director was Omri Lavie; NSO did not respond, and a spokesperson for TREO NOAL GP, general partner of the fund, said the lenders had seemingly organised a foreclosure after NSO failed to meet its financial obligations since 2021, that the fund had been denied basic corporate information, and that its investment had been and remained valueless. A register publication of 24 February 2023, as summarised by the same aggregator, records Dufresne in place of Diamond LIE as NorthPole Newco's shareholder. On 8 October 2025 Dufresne transferred all of NorthPole Newco's shares to Ohad Shazar Shalem Schremer. On 8 December 2025, by realisation of a pledge followed by a private sale, they passed to Hippocrene Ventures LLC, a Delaware company; the register notice does not name the pledgee. Under a share purchase agreement of 30 December 2025 Hippocrene sold them back to Schremer, who became sole shareholder again. ^{7 8 4 9 10 11 12 13}

analysisOn 10 October 2025 NSO's spokesperson told a US technology publication that "an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership", with the headquarters and core operations remaining in Israel under Israeli supervision; Israeli business reporting the same day named Robert Simonds as the group's leader, valued the deal at several tens of millions of dollars, expected it to include the divestment of NSO's roughly $500 million debt and said it needed approval from the Defence Ministry's export control agency, with Lavie's involvement ending. The spokesperson declined to name the investors or the amount and later declared his comments off the record, according to the US publication; Lavie did not immediately comment, and neither Simonds nor STX Entertainment responded. The 8 October 2025 transfer to Schremer described above is the change the register records. The retained documents do not name the investors or record the agency's decision. ^{14 15 11}

analysisOn 29 October 2019 WhatsApp and Facebook sued NSO Group Technologies and Q Cyber Technologies in the Northern District of California, alleging that between about April and May 2019 the defendants used WhatsApp servers to send malware to approximately 1,400 mobile phones. The defendants argued that they were immune because they acted for foreign governments; the district court and, in November 2021, the Ninth Circuit rejected that defence, and the court later granted partial summary judgment on liability. On 6 May 2025 a jury awarded $444,719 in compensatory and $167,254,000 in punitive damages; on 17 October 2025 the court remitted the punitive award to $4,002,471 and granted a permanent injunction, directing that the defendants' sovereign government customers, which it did not name, be excluded from its scope, and final judgment was entered on 12 November 2025. The two companies appealed to the Ninth Circuit on 19 November 2025; the retained records do not show the outcome of the appeals. ^{1 2 3 4 5 6}

analysisIn Israel, the Central District Court dismissed Q Cyber's withholding-tax appeal on 28 July 2026, holding that its payments to its foreign parent were to be taxed as dividends rather than treated as loan repayments, and ordered it to pay NIS 40,000 in costs; the court cancelled the penalty for failure to withhold tax, finding no fraudulent or false conduct. This is a district-court judgment, and the retained records do not show whether it was appealed. ^{7 8}

analysisSince a rule published on 4 November 2021, "NSO Group" has been on the US Entity List, with a licence required for all items subject to the Export Administration Regulations and a presumption of denial. The entry gives the Herzliya address that both NSO Group Technologies and Q Cyber Technologies used in their 2019 Israeli annual reports, without either company's register number. The official electronic Code of Federal Regulations, read on 20 October 2026, still shows the entry in the version in force from 16 July 2026; that records its presence, not licensing decisions under it. ^{9 10 11}

analysisTwo points about Q Cyber itself remain open in the retained record. The July 2026 tax judgment describes Omri Lavie, who testified for Q Cyber, as currently its controlling owner through the chain of companies and, accepting the Assessing Officer's remark, as its sole shareholder with an interest in the outcome; the judgment does not date that "currently", and Luxembourg register publications record that Lavie's holding company transferred NorthPole Newco to another person on 8 October 2025, when he resigned as its manager, and notices of 28 and 30 October 2025 record his removal from the boards of Q Cyber Technologies S.à r.l. and OSY Technologies. And in the Madrid case brought in May 2022 by Gonzalo Boye on behalf of at least 19 Pegasus targets against NSO, its three founders, Q Cyber Technologies and OSY, the sources do not say whether the Israeli Q Cyber Technologies Ltd or the Luxembourg Q Cyber Technologies S.à r.l. was named, and no outcome is recorded. ^{1 2 3 4 5}