The fight for control of NSO and Q Cyber, 2021–2023

analysisIn July 2021 British press reported that public investors in the fund holding NSO's majority stake, led by the Oregon public pension fund, were in talks to hand the fund's management to the US consultancy Berkeley Research Group (BRG); Novalpina and NSO declined to comment and BRG did not immediately respond. According to the fund's general partner, the investors voted by 99% that month to remove Novalpina as general partner, and an English High Court judgment of 2025 records that Treo GP replaced Novalpina Capital Partners 1 GP Sarl on 27 August 2021. The European Parliament inquiry report, relying on press and NGO sources, says BRG then launched investigations into the lawfulness of NSO's activities and its compliance with the US blacklisting, and that NSO's management obstructed BRG's inquiries in May 2022. ^{1 2 3 4}

analysisIsraeli business reporting in 2022 said that the limited partners, including Centerbridge Partners and the Oregon and Alaska pension funds, wanted a manager to prepare the assets for sale. It said BRG joined NSO's board in September 2021 and by the end of that year controlled the board of Triangle Holdings, where chairman Asher Levy, nominated by Novalpina, was replaced by BRG partner Finbarr O'Connor. Levy told the press in January 2022 that he had been appointed to represent Novalpina and was making way for BRG's appointee, that he had resigned when BRG took control in July 2021 and served out his term, and that his departure was unrelated to reports about NSO. A March 2023 report says BRG's control ended when the new controlling owner replaced the directors down the chain, including those appointed by BRG. ^{5 6 7 8}

analysisA notice published in Luxembourg's electronic register on 4 January 2023 lists Triangle's class A directors as Finbarr O'Connor and Howard Berkowitz, appointed on 4 October 2021 until the 2026 general meeting, and Gavin Farrell and Jeffrey Dunn, appointed on 14 January 2022 until the 2027 general meeting, all with an address care of a New York law firm. At NorthPole Newco, register summaries by a company-data aggregator record Tamara Makarenko as a manager from 22 December 2021, replacing Gaëtan Dumont and Allen Foley, until 4 January 2022, Anthony Levy from 24 December 2021, and Asher A. Bornstein and Makarenko from 29 December 2022, with Anthony Levy leaving on 20 January 2023. The UK Companies House record of Triangle as an overseas company (FC040779) lists eight active directors, each shown as appointed on 1 August 2023: Berkowitz, Dunn, Farrell and O'Connor with a New York correspondence address, Makarenko and James Ward, and NSO's founders Shalev Holy (Hulio) and Omri Lavie; Luxembourg notices give earlier appointment dates for some of them. ^{9 10 11}

analysisCiting press reports, the European Parliament inquiry report says NSO reportedly had revenues of about USD 243 million in 2020, but that the Pegasus Project revelations, the Apple and Meta lawsuits, the US blacklisting, the tightening of Israel's export regime, inquiries in several countries and frictions within the fund led to a severe decline in profit, and that its debt at one point reached 6.5 times its normal annual revenue; no NSO accounts were retained. In a 2025 petition to a New York federal court, the fund's general partner stated that in October 2021 NSO acknowledged its precarious position and asked for an immediate $10 million to meet payroll, and that a few days after the money was provided, on 3 November 2021, NSO was put on the US Entity List. ^{1 2}

analysisIn January 2022 Israeli business reporting said that, at the request of BRG as NSO's controlling shareholder, Judge Hagai Brenner of the Tel Aviv District Court appointed a lawyer as temporary trustee of the drone company Convexum, announced two years earlier as acquired by NSO for $60 million. The report said Convexum had in practice been controlled by Triangle, owned 70% by Novalpina and 30% by NSO's management and employees, and that BRG's court papers put NSO's debts at $460 million while NSO negotiated a sale to two US funds with bids of $1 billion to $1.2 billion. A year later the press reported that the proceedings ended with Convexum's separation from NSO, which NSO's management had opposed. ^{1 2}

analysisAccording to court records described in Israeli business reporting in March 2022, the group around Shalev Hulio worked on selling NSO together with Convexum against BRG's position. One offer, from Integrity Partners, proposed injecting $300 million at a valuation of $1 billion to $1.5 billion, leaving the Hulio group with 30%, focusing sales on Western democracies and repaying debt by 2029. NSO Group called a January 2022 report of talks with Integrity Partners full of inaccuracies and half-truths but confirmed it was talking to US-based funds. No such sale took place, according to the later ownership record. ^{3 4}

analysisThe same court documents show NSO's management declining to give BRG full financial information, saying that disclosure to a foreign investor required approval from the Israeli Defence Ministry's export control body because some of it was classified; the approval had reportedly not been received. In court papers reported in February 2022, BRG's lawyers said that since the Pegasus Project the only new potential Pegasus bookings came from "elevated risk customers", while lawyers for the lenders said BRG's approach had shut the company off from new customers and deepened its liquidity crisis. A source familiar with NSO said BRG wanted the company to shut down or stop some activities with customers, which NSO said its legal obligations did not allow unless customers misused the system. These are the parties' positions as reported by the press. ^{3 5}

analysisIn January 2023 Q Cyber Technologies itself sued BRG, the parent companies, the syndicate of lenders and the founders Hulio and Lavie in the Tel Aviv District Court. As Israeli business reporting described its claim, it asked the court to declare who its board of directors was, whether the appointments of Tamara Makarenko and Asher Alan Bornstein by BRG were valid, and whether a board decision of 29 December 2022 requiring it to hand over information and documents was valid, and sought urgent interim relief preserving the position before the new directors were appointed. Q Cyber said that it and its management took no position on the merits of the defendants' dispute but faced serious consequences if they complied with decisions later found unlawful. The case number is not given in the retained documents. In February 2023 a notice filed in the proceeding told the court that the lenders had exercised their rights under the loan agreements, and according to a March 2023 report the new controlling owner then replaced the directors down the chain, including those appointed by BRG. No ruling on Q Cyber's claim is recorded in the retained documents. ^{1 2}

analysisAccording to Q Cyber's claim as reported, a Luxembourg court ruled in December 2022, in a dispute among Novalpina's directors, that acts of directors appointed by Novalpina between August and December 2021 were void, after which BRG moved to appoint Makarenko and Bornstein to the group companies. On 16 December 2022 the minority shareholders Hulio and Lavie wrote that the new directors' decisions were invalid, and on 29 December the lenders, who had lent the group about half a billion dollars, also questioned their legitimacy. The new directors held the board meeting on 29 December regardless and demanded commercially sensitive documents; Makarenko declined to produce the decision appointing her and relied on an opinion of English counsel. The Luxembourg ruling itself was not retained. ¹

analysisOn 22 January 2023 some respondents, including the fund's side and the directors it appointed, asked the court to reject the interim request, alleging bad faith. As reported the next day, they argued that Hulio, although he had formally resigned as chief executive in August 2022 and left the board, remained extensively involved in decisions through the current chief executive Yaron Shohat; that because management concealed its actions the company might be selling its products, which they called offensive cyber weapons, to problematic or high-risk customers; and that Hulio had attended the disputed board meeting without protest and voted. These were allegations in court papers, not findings of the court. NSO's response was: "Our request for declaratory relief is our response." ³

analysisAccording to the European Parliament report, on 25 April 2022 two of Novalpina's former general partners sued BRG in Luxembourg for Novalpina's reinstatement as general partner and the suspension of BRG's decisions; the court dismissed the demands and BRG remained in charge of the fund. The fund's general partner said in a November 2022 press release that on 6 May 2022 the fund and its vehicles had filed a criminal complaint with civil-party joinder against Stefan Kowski, Bastian Lueken and Gerhard Schmidt for abuse of powers, under investigation by an investigating judge, and that a Luxembourg judge had rejected Novalpina's expedited attempt to confirm a veto right. The complaint is an allegation; no response from Kowski, Lueken or Schmidt and no outcome of the investigation is recorded in the retained documents. ^{1 2}

analysisIn a March 2025 petition in the Southern District of New York (1:25-mc-00133), the general partner TREO NOAL GP said the fund's investment in NSO is the subject of proceedings in the Commercial Court of England and Wales against Novalpina's founders, claiming damages for conspiracy among other things, and sought discovery from the law firm Weil, Gotshal & Manges for use in Luxembourg; the defendants filed defences to the English claim in January 2025, according to the petition's exhibit list. US legal press reported in 2025 that the fund's 2021 difficulties and its founders' falling-out were being litigated in Luxembourg. The claims are unadjudicated in the retained records. ^{3 4}

analysisUS legal press reported in October 2025, citing British business press and court documents, that Weil Gotshal partner Gerhard Schmidt invested €5 million in Novalpina Capital in 2017 without the usual fees and chaired it, advised Novalpina on the NSO deal and sat on the board of the holding company overseeing NSO. According to a party's court filing he "would have been voting" when NSO's oversight board moved to renew Saudi Arabia's access to Pegasus after the murder of Jamal Khashoggi, access that two unnamed people familiar with the matter said was restored by mid-2019. In April 2019 a coalition of NGOs had questioned the independence of Schmidt, reportedly non-executive chairman of Novalpina Capital Group, as part of Novalpina's legal compliance team. NSO said it complies fully with all applicable laws and sells only to vetted intelligence and law enforcement agencies; no response from Schmidt or his firm is recorded in the retained documents. ^{3 5}