---
title: "Evidence records"
language: en
canonical: https://dossiertwist.com/dossiers/q-cyber-technologies/evidence-records/
as_of: 2026-10-22
keywords: ["Q Cyber Technologies","L.E.G.D. Company","NSO Group Technologies","Pegasus","OSY Technologies","Q Cyber Technologies S.à r.l.","NorthPole Newco","Triangle Holdings","Francisco Partners","Novalpina Capital","Berkeley Research Group","Dufresne Holding","Omri Lavie","Shalev Hulio","WhatsApp v. NSO Group","Entity List","Westbridge Technologies","withholding tax appeal","export controls","Circles"]
---

# Evidence records

**Question.** Which records support the articles?

**Answer.** Full assertions with source references, qualifications, responses and known outcomes. The topic articles explain these records in context.

## Export controls, the US Entity List and lobbying by NSO and Q Cyber

- Documented: Q Cyber Technologies Ltd is a private Israeli company, number 514971522. It was incorporated on 2 December 2013 as L.E.G.D. Company Ltd, and on 29 May 2016 the Israeli Registrar of Companies certified its change of name to Q Cyber Technologies Ltd. [src-004]
- Attributed: NSO Group's 2025 transparency report states that its products are classified as defence articles under Israeli law and that every marketing activity and export transaction requires prior authorisation from the Israeli Ministry of Defense through its Defense Exports Control Agency (DECA), with transaction-specific licences that are subject to renewal and ongoing oversight. A legal opinion published by Novalpina in 2019, as described in the 2021 NGO report, likewise confirmed that all of NSO Group's then product line fell within Israel's defence export control regime under the 2007 Defence Export Control Law. [src-084] [src-021]
  - Qualification: The company's own description and a legal opinion published by its then owner.
- Documented: On 6 December 2021 Israel's Defense Export Controls Agency announced that it had tightened control of cyber exports by publishing an updated End User Declaration, which a state seeking a cyber or intelligence system must sign as a condition for the export licence; the statement does not name NSO. [src-078]
- Attributed: In July 2021 Israel's Defence Ministry said that if NSO Group's products were found to have been used in violation of the licence conditions or of the purchasing countries' declarations it would take appropriate action, and that the State of Israel does not have access to the information collected by NSO Group's customers. [src-082] [src-078]
  - Qualification: Ministry statement as reported by Israeli press.
  - Outcome: On 6 December 2021 the ministry's export control agency announced that it had tightened control of cyber exports through an updated End User Declaration; the announcement does not name NSO, and no retained document records a finding about NSO's licences.
- Documented: In the Foreign Agents Registration Act filing received on 25 December 2019, Mercury Public Affairs placed its foreign principal Q Cyber Technologies Ltd in the FARA category "controlled by a foreign government, foreign political party, or other foreign principal", explaining that some of its technology offerings were expected to be marketed to government clients and that the Israeli Ministry of Defense may deny such sales; the attached agreement, signed for Q Cyber by its general legal counsel, retained Mercury from 15 December 2019 to 30 November 2020 and month to month thereafter for $120,000 a month plus a one-time compliance fee of $5,000. [src-064] [src-021]
- Attributed: US public-relations trade press reported in January 2020 that Israel's Q Cyber Technologies had signed Mercury Public Affairs to a $1.2 million contract for crisis communications, media outreach and government relations work concerning the WhatsApp suit, and the 2021 NGO report notes that a statement distributed by Mercury on behalf of Q Cyber Technologies Ltd. was filed with the Justice Department's FARA unit on 2 October 2020. [src-099] [src-021]
  - Qualification: Trade press account; the contract terms are recorded in the FARA filing.
- Attributed: A US technology-policy publication reported in March 2026, citing US business press and lobbying disclosures, that NSO Group's campaign to be removed from the US Entity List cost at least $7.6 million in lobbying fees between 2020 and 2024 and at least $190,000 in 2025; it lists firms engaged through NSO's parent Q Cyber, including Mercury Public Affairs (2019–2021) and Arnold & Porter (timing unknown), and Paul, Weiss through Q Cyber's owner OSY Technologies (2019), and names Michael Flynn among earlier advisers, paid nearly $100,000 by NSO Group's parent companies. [src-101]
  - Qualification: Press compilation of disclosure records.
  - Outcome: According to the same publication, NSO's outreach, including contacts with Jared Kushner and approaches from the Israeli prime minister's office, did not succeed; in May 2025 National Security Council officials turned away Vogel Group lobbyists seeking a meeting on NSO's behalf, and Vogel's lobbying for NSO lasted only a few months.
- Documented: By a rule published in the Federal Register on 4 November 2021 (document 2021-24123), the US Commerce Department's Bureau of Industry and Security added NSO Group, at 22 Galgalei Haplada, Herzliya, to the Entity List under section 744.11(b) of the Export Administration Regulations, requiring a licence for all items subject to the regulations with a presumption of denial. The End-User Review Committee found that NSO Group and Candiru developed and supplied spyware to foreign governments that used it to target government officials, journalists, businesspeople, activists, academics and embassy workers, contrary to US national security and foreign policy interests. [src-025]
  - Qualification: The entry names "NSO Group" at the address that both NSO Group Technologies and Q Cyber Technologies gave in their 2019 Israeli annual reports; the rule does not name either company's register number.
- Documented: The official electronic Code of Federal Regulations shows the NSO Group entry, with its presumption-of-denial licence policy, in the version of the Entity List in force from 16 July 2026 with no end date and in each listed version since 26 November 2021, none marking it as removed. [src-086] [src-087]
  - Qualification: Read from the eCFR search interface on 20 October 2026; it records the entry's presence, not any licensing decisions made under it.
- Attributed: A screening service checked in October 2026 returned an entry for "NSO Group" in the US Consolidated Screening List under the Bureau of Industry and Security's Entity List programme (US-BIS-EL), with the topic export control and country Israel. [src-008]
  - Qualification: Screening result; it reflects the Entity List designation described above and is not a separate sanctions designation.
- Attributed: An Israeli investigative outlet reported in July 2022, with a US non-profit newsroom, that after the listing NSO spent hundreds of thousands of dollars on US lobbyists, lawyers and public relations to be removed, and that Israeli government contacts with the US administration were led by Israel's National Security Council, part of the Prime Minister's Office. [src-093] [src-015]
  - Qualification: Press account; the White House statement is quoted by the outlet.
  - Response: The White House said it was not and had not been involved in considering any request to remove a foreign commercial spyware company from the Entity List.
  - Outcome: Luxembourg press reported in April 2026 that the listing remained in force and that no decision to remove NSO had been published; the official register still shows the entry.
- Attributed: In a letter of 6 May 2026 to the US Commerce Secretary, Representative Summer L. Lee wrote that since its Entity List designation in November 2021 NSO Group had experienced a "financial freefall" and nearly defaulted on $500 million of debt, and that in 2023 it reportedly spent nearly $1 million on lobbying; the letter requested a briefing on the purchase of NSO by an American company and on contacts with David Friedman. [src-077]
  - Qualification: A member of Congress's letter relying on press reports; not a finding of any agency.
- Attributed: According to NSO's transparency reports as summarised by the press in January 2026, the company said it suspended or terminated six unnamed government customers in 2022–2023 at a revenue loss of $57 million and rejected more than $20 million of new business in 2024 for human rights reasons; critics quoted by the publication saw the 2025 report as part of a campaign to leave the Entity List. [src-080]
  - Qualification: The company's own figures; the customers are not named. According to the publication, the 2025 report, unlike earlier ones, lacks figures on how many customers were rejected, investigated, suspended or terminated over human rights abuses.
  - Response: Asked for comparable figures, an NSO spokesperson had not answered by the publication's deadline.
- Attributed: Luxembourg's foreign ministry and economy minister stated in February 2019, according to the 2021 NGO report, that the Luxembourg entity linked to NSO Group had never sought an export licence in Luxembourg. The 2023 European Parliament report records that after the 2021 NGO report identified nine NSO-related companies in Luxembourg in June 2021, Foreign Minister Jean Asselborn wrote to each, and that none of the nine was authorised to export cyber-surveillance products from Luxembourg. [src-021] [src-066] [src-015]
  - Qualification: Government statements as reported.
  - Response: According to the European Parliament report, citing Luxembourg press, NSO Group replied that it exports its spyware only from Israel with the consent of the Israeli government; Asselborn said in October 2021 that he could not verify that.
  - Outcome: Luxembourg press reported in April 2026 that, according to the ministers' answer to a parliamentary question, the export control office had received no requests from these companies.
- Documented: Written question No. 3833, "Activities of NSO Group in Luxembourg and possible links with Togo", was tabled in Luxembourg's Chamber of Deputies on 23 March 2026 by deputies Sven Clement and Marc Goergen and answered in writing on 28 April 2026 by the Minister of the Economy, Lex Delles, and the Minister of Foreign Affairs and Foreign Trade, Xavier Bettel; Luxembourg press reported that the answer confirmed that the export control office had received no requests from the nine NSO-affiliated entities since the July 2021 letters. [src-028] [src-015]
  - Qualification: The text of the ministers' answer is not on the retained page; its content is the press account.
- Attributed: NSO Group told the 2021 NGO report's authors that NSO Group Technologies Ltd., Q Cyber Technologies Ltd., Convexum, Wayout and the Bulgarian group companies export products and obtain licences from the relevant authorities for all products that require them, that group entities export from Israel, Bulgaria and Cyprus, and that each of those countries' authorities had at some point denied group licence applications. Novalpina said in March 2019 that some NSO products are exported from the EU, from Bulgaria or Cyprus, after consultation with the competent authority. The 2023 European Parliament report records that NSO denies that Pegasus is exported from Cyprus or Bulgaria and that the Cypriot and Bulgarian governments deny having granted export permits to NSO companies. [src-021] [src-066]
  - Qualification: Competing accounts; the European Parliament report calls the Bulgarian and Novalpina statements contradictory.
  - Response: NSO Group: Pegasus is not exported from Cyprus or Bulgaria.
- Attributed: According to the 2021 NGO report, Circles Bulgaria EOOD and Magnet Bulgaria EOOD, held through IOTA Holdings, a subsidiary of OSY, are registered to obtain Bulgarian export licences; NSO Group said Magnet Bulgaria is inactive, that its registration with the Bulgarian export control authority expired in 2020, and that it never obtained licences to export the products named Vole or Pixcell. [src-021]
  - Qualification: The report's reading of Bulgarian registers and NSO's response.
  - Response: NSO Group: Magnet Bulgaria is inactive and its registration lapsed in 2020.
- Attributed: In June 2026 an international human rights organisation and a European news outlet reported, from Bulgarian licensing records for 2018–2023, that Bulgaria's export control authority licensed Circles BG, a Sofia-based company affiliated with NSO Group, to sell interception systems, mobile-tracking tools and surveillance infrastructure to intelligence agencies in Azerbaijan, Serbia, Malaysia and Mexico; the human rights organisation said the records also show licensed exports to Q Cyber Technologies and NSO Group in Israel, and the news outlet reported that in at least one case involving Brazil an export transited through Luxembourg-based Q Cyber Technologies. The outlet reported that NSO Group bought technology from Circles for $119,941 in October 2021, later transferred to the Home Front Command of Israel's Defence Ministry. [src-088] [src-089]
  - Qualification: Reporting on leaked licensing records that the outlets reviewed but did not publish; it does not establish that any export was unlawful, and the human rights organisation noted that the licences do not show whether the technology was actually exported. The human rights organisation describes Q Cyber Technologies as the umbrella company formed when Circles was bought in 2014.
  - Response: Circles did not respond to repeated requests for comment from either outlet; Bulgaria's foreign ministry said that the documentation provided by Circles showed the technologies were intended for crime and terrorism investigation and search and rescue, and that all relevant circumstances, including end-use documents, are assessed when examining applications.
- Documented: In a 2026 reply to an access-to-information request, annexed to the human rights organisation's report, Bulgaria's Ministry of Economy and Industry provided copies of surveillance export permits with the names of the exporter and end user, the type of product and the permit numbers deleted as commercially sensitive; an appeal against the restricted access was pending in court. [src-100]
  - Qualification: The redacted copies do not show which company was the exporter.
- Attributed: In an open letter of April 2019 to Novalpina Capital, copied to NSO Group and Francisco Partners, a coalition of NGOs including Amnesty International, Access Now, the Committee to Protect Journalists, Human Rights Watch and Privacy International wrote that Novalpina had provided background on NSO Group's compliance with export control rules but no data on its export licences. [src-108] [src-021]
  - Qualification: The coalition's account of Novalpina's reply.
  - Response: Novalpina had answered the coalition's first letter on 1 March 2019; the 2021 NGO report cites that reply, which was not retained.

## Q Cyber Technologies Ltd: the Israeli parent of NSO Group

- Documented: Copies of the Israeli companies register published by two Israeli company-information sites list Q Cyber Technologies Ltd as an active private limited company incorporated on 2 December 2013, with the stated purpose of engaging in any lawful business and a last annual report for 2025. One copy gives its address as Yael Man 1, Ramat HaSharon; the other gives its registered address as HaAluf Yitzhak Hofi 1, Ramat HaSharon. [src-002] [src-003]
  - Qualification: Read from secondary copies of the register rather than the register itself; the two copies give different street addresses in Ramat HaSharon and neither records when the address changed.
- Documented: In its annual report to the Israeli Registrar of Companies updated to 7 January 2019, Q Cyber Technologies Ltd gave its address as 22 Galgalei Haplada, Herzliya, the same address that NSO Group Technologies Ltd gave in its own annual report updated to the same date. [src-004]
- Documented: The same register copies give NSO Group Technologies Ltd the same address as Q Cyber Technologies in each copy: Yael Man 1, Ramat HaSharon in one and HaAluf Yitzhak Hofi 1, Ramat HaSharon in the other, with a last annual report for 2025. [src-014] [src-113]
  - Qualification: Secondary copies of the register; they show a shared address for the two companies, not which company occupies the premises.
- Documented: NSO Group Technologies Ltd (registered in Israel as N.S.O. Group Technologies Ltd, company number 514395409) was incorporated as a limited liability company on 25 January 2010. [src-004]
- Documented: According to the WhatsApp complaint, until at least June 2019 NSO Group's website stated that NSO Group was "a Q Cyber Technologies company"; the archived page filed as an exhibit reads "NSO Group, a Q Cyber Technologies company". [src-004] [src-069]
- Attributed: In 2021 correspondence with the authors of an NGO research report, NSO Group stated that NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. develop, market and export Pegasus and related analytical products for governmental use, and provide sales, marketing and administrative support and oversight to their affiliates. [src-021]
  - Qualification: NSO Group's own description of the two companies' functions, quoted in the report.
- Attributed: Israeli business reporting said in January 2023 that the difference between Q Cyber Technologies, a company of the NSO group, and NSO itself might be purely symbolic, and in March 2023 that Q Cyber was in every respect identical to NSO, its chief executive Yaron Shohat also being chief executive of the NSO Group. [src-011] [src-048] [src-080]
  - Qualification: Characterisation by the publication when reporting Q Cyber's own lawsuit; no register record of Q Cyber's officers after 2019 was retained.
  - Outcome: According to press reports of January 2026, Shohat stepped down as chief executive after the 2025 change of ownership.
- Attributed: According to Israeli register records cited in a 2021 NGO research report, Q Cyber Technologies Ltd has been since 2019 the sole shareholder of two Israeli companies, NGTP Ltd (number 516043551, incorporated 20 June 2019) and S. Sesame Technology Ltd (number 516080850, incorporated 5 September 2019). NSO Group told the authors that both were inactive and had been created for potential future plans that had not materialised. [src-021] [src-039] [src-040]
  - Qualification: The shareholding is stated by the report from register records that were not themselves retained.
  - Response: NSO Group: the two companies are inactive.
  - Outcome: Copies of the Israeli register list both companies as active, with annual reports filed for 2025.
- Documented: Register copies list NGTP Ltd and S. Sesame Technology Ltd as active private companies with last annual reports for 2025. NGTP's registered address is HaAluf Yitzhak Hofi 1, Ramat HaSharon, the address shown for Q Cyber and NSO in the same source; S. Sesame Technology's registered address is in Neve Daniel. [src-039] [src-040]
  - Qualification: Secondary copies of the register; they do not show shareholders or officers.
- Documented: United States courts hearing suits against both companies have treated them together: the Ninth Circuit's opinion of 8 November 2021 and the Northern District of California's orders of 8 March 2024 and 30 September 2026 refer to NSO Group Technologies and Q Cyber Technologies jointly as "NSO", and the Eastern District of Virginia's memorandum filed on 26 October 2023 describes NSO Group as a subsidiary of Q Cyber, a private company also incorporated in Israel. [src-053] [src-058] [src-026] [src-067]

## How Francisco Partners bought NSO through Q Cyber (2014–2019)

- Documented: The Israeli Central District Court's judgment of 28 July 2026 records that on 5 February 2014 OSY Technologies S.à r.l. signed an agreement with NSO Group Technologies and its shareholders to acquire all rights in NSO in two stages: a cash payment of $70 million for 70% of the rights and, for the remaining 30%, an exchange of NSO shares for shares in Triangle Holdings, which made NSO's original shareholders partners in Francisco Partners' cyber business. [src-001]
  - Qualification: Findings of fact recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.
- Documented: According to the same judgment, Q Cyber's shares were transferred to OSY Technologies on 17 March 2014, after which OSY is referred to as its parent company; on 19 March 2014 70% of NSO's shares were transferred from OSY to Q Cyber under a trust agreement, and on 30 November 2014 the remaining 30% of NSO's shares were exchanged for shares in Triangle Holdings. [src-001]
  - Qualification: Findings of fact recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.
- Documented: Note 1 to Q Cyber's financial statements, quoted in the judgment, states that during 2014 the company acquired 100% of the shares of N.S.O. Group Technologies Ltd, its subsidiary, from its parent company OSY Technologies S.à r.l., incorporated in Luxembourg. [src-001]
  - Qualification: Quoted by the court from Q Cyber's financial statements, which were not themselves retained.
- Documented: The judgment describes OSY Technologies as a Luxembourg-resident company that Francisco Partners held not directly but through a chain of companies, headed under Francisco Partners by a foreign company, Triangle Holdings S.A. [src-001]
  - Qualification: Findings of fact recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.
- Attributed: In 2021 correspondence with the authors of an NGO research report, Francisco Partners stated that from March 2014 to 18 March 2019 its fund Francisco Partners III owned an indirect controlling interest in NSO Group through OSY Holdings Ltd., a Cayman Islands vehicle wholly owned by the fund, which in turn owned a controlling interest in Triangle Holdings. It added that OSY Holdings had never exported products or services and had done nothing other than hold its Triangle interest. [src-021] [src-068]
  - Qualification: Francisco Partners' own account. It calls OSY Holdings an exempted limited partnership, while the Triangle minutes of 1 December 2014 describe OSY Holdings Limited as an exempted company registered with the Cayman Islands Companies Register under number MC-284745.
  - Outcome: According to the same correspondence, OSY Holdings had no remaining assets or liabilities and was in the process of being dissolved under Cayman Islands law.
- Attributed: According to Luxembourg and Cayman records cited in the 2021 NGO report, OSY Technologies S.à r.l. was incorporated on 3 February 2014 with OSY Holdings Ltd. (registered in the Cayman Islands on 30 January 2014) as its sole shareholder, and from March 2014 OSY Technologies was the sole shareholder and active director of L.E.G.D. Company, later Q Cyber Technologies Ltd. [src-021] [src-062]
  - Qualification: Stated by the report from register records; OSY's own 2024 accounts confirm the incorporation date.
- Attributed: According to the 2021 NGO report, Triangle Holdings SA and Square 2 S.à r.l. were each incorporated in Luxembourg on 21 November 2014. OSY Holdings Limited became Triangle's sole shareholder, with Eran Gorev, a Francisco Partners director and newly appointed NSO chair, as its sole director; Triangle became Square 2's sole shareholder, and Square 2 took full ownership of OSY Technologies through share transfers from OSY Holdings. Luxembourg register publications summarised by a company-data aggregator record Square 2 as OSY's shareholder from 28 November 2014. [src-021] [src-005]
  - Qualification: Ownership chain as stated by the report and an aggregator summary of Luxembourg register publications.
- Documented: Minutes of an extraordinary general meeting of Triangle Holdings held on 1 December 2014, published in Luxembourg's official gazette, record that before the meeting OSY Holdings Limited, a Cayman Islands company, was the sole shareholder, and that the capital was increased from USD 48,038.80 to USD 74,548.10 by issuing new class A and class D shares. [src-068]
- Documented: The new Triangle shares were subscribed on 1 December 2014 by Omri Lavie (67,263 class D shares, 9% of the capital) and Shalev Hulio, recorded as Shalev Holy (67,263 class D shares, 9%), each contributing 50 NSO shares; Eddy Shalev (13,444 class D shares, 1.8%) contributing 10 NSO shares; ESOP Management and Trust Services Ltd., an Israeli trust company (20,767 class A shares, 2.8%), contributing 20,767 NSO shares; and, for cash, Global Seven Group LP, a British Virgin Islands limited partnership (89,458 class D shares, 12%) and Eran Gorev (6,336 class D shares, 0.8%). [src-068]
  - Qualification: The minutes do not name Global Seven Group's general partner or beneficial owners.
- Attributed: The 2021 NGO report summarises the outcome as the new shareholders holding about 35.5% of Triangle Holdings, including Alexei Voronovitsky (0.1%), and OSY Holdings Ltd., that is Francisco Partners, the remaining 64.5%; NSO Group told the authors that ESOP Management and Trust Services held shares and options on behalf of employees under the company's employee stock ownership plan, an entity required by the applicable tax rules. [src-021]
  - Qualification: Percentages as summarised by the report.
  - Response: NSO Group explained the trust company's role as described.
  - Outcome: According to the report, Triangle's board resolved on 18 February 2019 to buy back ESOP's shares, so that ESOP was no longer a Triangle shareholder.
- Documented: By resolution of 1 December 2014 Triangle Holdings appointed as directors Alessandro Celli, Jonathan Murphy, Andrew Kowal and Matthew Spetzler, all with professional addresses at Francisco Partners' London or San Francisco offices, Frédéric Gardeur, Omri Lavie, Shalev Holy (Hulio) and Boaz Goldman; Andreas Koutsos was appointed observer. [src-068]
- Attributed: According to Triangle minutes summarised in the 2021 NGO report, Boaz Goldman of the Circles group sat on Triangle's board from December 2014, and on 1 April 2019 Triangle acknowledged the resignations of Boaz Goldman, Eran Gorev, Andrew Kowal, Jonathan Murphy and Matthew Spetzler as class A directors. [src-021]
  - Qualification: Summary of the minutes in the report.
- Documented: NSO Group Technologies' annual report to the Israeli Registrar of Companies, updated to 7 January 2019, names Q Cyber Technologies Ltd as NSO's director from 19 March 2014 and a financial director named Idisis. [src-004]
- Documented: The same annual report lists NSO's shareholders as Q Cyber Technologies Ltd, holding 118,263 ordinary shares, 8,936 ordinary A shares and 295,170 preferred A shares, and NSO Group Technologies Ltd itself, holding 67,453 ordinary shares. [src-004]
- Attributed: The 2021 NGO report noted that NSO Group Technologies held 67,453, or 36%, of its own allotted ordinary shares and that it was unclear which individuals exercised ownership of them. NSO Group replied that its shareholders are Q Cyber Technologies Ltd. and NSO Group Technologies Ltd. itself, that under Israeli law a company may hold its own shares, for example after a buyback, and that the full ownership rights of NSO Group Technologies Ltd. are therefore held by Q Cyber Technologies Ltd. [src-021]
  - Qualification: The report's observation and NSO Group's explanation; the buyback itself is not documented in the retained records.
  - Response: NSO Group: the treasury shares result from a buyback, and Q Cyber holds the full ownership rights.
- Documented: Q Cyber's own annual report, updated to 7 January 2019 and signed on 16 June 2019, lists OSY Technologies S.à r.l. (Luxembourg register number B184226) as its sole shareholder with all 100,000 ordinary shares, OSY as its director from 17 March 2014, and Yifa Idisis as financial director. [src-004]
- Attributed: Accounts of the 2014 price differ. The Israeli judgment records a $70 million cash payment for 70% of the rights in NSO; the 2021 NGO report states that Francisco Partners III acquired a 70% stake for $115 million in a deal announced in March 2014 and reportedly approved by Israel's Ministry of Defense; and a 2017 news report puts the purchase at $120 million. [src-021] [src-104]
  - Qualification: Three figures from different sources; they may measure different components of the same transaction, and none of the retained records reconciles them.
- Attributed: A US business magazine reported in December 2017 that Francisco Partners, the private equity firm that owned NSO Group, had months earlier failed to sell part of the company to the New York-based Blackstone Group at a reported valuation of $1 billion, and that the deal collapsed amid reports that summer about the use of NSO's spyware in Mexico. [src-119]
  - Qualification: Press account; no other retained record describes the negotiations.
  - Outcome: The sale did not take place.
- Attributed: According to the judgment, in parallel with the NSO purchase Francisco Partners also acquired, through OSY on 1 December 2014, the foreign Circles group of companies, which was likewise active in the cyber field. The 2021 NGO report states that Circles was founded in 2010 by Tal Dilian, Boaz Goldman and Eric Banoun, is known for technology exploiting SS7 vulnerabilities for surveillance, and was acquired by Francisco Partners for $130 million in 2014; NSO Group told the authors that the Circles-linked entity CT-Circles Technologies Ltd. is not part of the NSO Group. [src-001] [src-021]
  - Qualification: The founders, technology description and price are the report's account.
  - Response: NSO Group: CT-Circles Technologies Ltd. is not part of the group.
- Attributed: The 2021 NGO report, citing OSY's 2014 accounts, states that OSY Technologies also acquired IOTA Holdings Ltd., registered in Cyprus on 4 November 2014, the parent of CS-Circles Solutions Ltd., Global Hubcom Ltd. and MS Magnet Solutions Ltd.; CS-Circles Solutions owns Circles Bulgaria EOOD (incorporated in July 2017) and MS Magnet Solutions owns Magnet Bulgaria EOOD (incorporated in April 2014). [src-021]
  - Qualification: Group structure as described in the report.
- Attributed: A 2023 European Parliament inquiry report, relying on the 2021 NGO report, states that Circles Technologies was sold to Francisco Partners for just under $130 million and that Francisco Partners obtained 90% of NSO Group, with Circles and NSO merged under L.E.G.D Company Ltd., known as Q Cyber Technologies Ltd. since 29 March 2016. [src-066]
  - Qualification: The report's figures differ from the primary records: the Israeli name-change certificate is dated 29 May 2016, and the other accounts give Francisco Partners 70% of NSO rather than 90%.

## Q Cyber's withholding-tax appeal in Israel (judgment of July 2026)

- Documented: Q Cyber Technologies Ltd appealed to Israel's Central District Court in Lod (TA 59924-03-22, Judge Avi Gorman) against assessments of tax that the Kfar Saba Assessing Officer said it should have withheld for the tax years 2014–2015 and 2017–2018. The dispute was whether the sequence of steps taken to acquire an Israeli company, financed by loans from a foreign parent company and their repayment, was an artificial transaction under section 86 of the Income Tax Ordinance. [src-001]
- Documented: The judgment states that Q Cyber was incorporated on 2 December 2013 as a shelf company named L.E.G.D. Ltd and later renamed, and a 2026 review of the judgment by an Israeli law firm reports the court's finding that at the time of the acquisition Q Cyber was a shelf company with no employees, no substantive operations and no bank account. [src-001] [src-116]
- Documented: According to the judgment, between 2014 and 2018 Q Cyber repaid the loans from its parent OSY using loans and dividends it received from its subsidiary NSO; more than $86 million of the funds used to repay the loans actually passed directly from NSO to OSY, not through Q Cyber's bank account. The court also records that in 2016 NSO declared a dividend of about $38.4 million to Q Cyber, which stayed with NSO to repay Q Cyber's loans from NSO, and that the roughly $86 million Q Cyber paid to OSY repaid the loans taken to buy NSO's shares in 2014. [src-001]
  - Qualification: Findings recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.
- Attributed: The Assessing Officer argued that the purpose of the arrangement was to avoid tax on dividends and on the transfer of profits abroad, contrary to Israel's two-tier taxation under which dividends distributed to a foreign-resident company are taxable. [src-001] [src-116]
  - Qualification: The parties' positions as summarised at the opening of the judgment.
  - Response: Q Cyber argued that the transaction followed accepted practice, rested on substantive commercial reasons for creating and operating an Israeli company, and that the repayment of the loan to its foreign parent was not a dividend and not taxable.
  - Outcome: On 28 July 2026 the court accepted the Assessing Officer's position and dismissed the appeal.
- Documented: The court held that the arrangement was an artificial transaction: had NSO's profits been distributed directly to the Luxembourg company, the dividend would have borne 10% tax under the Israel–Luxembourg tax treaty, whereas interposing Q Cyber allowed the funds to move as loan repayments without that tax. It found that Q Cyber had not proved a fundamental commercial purpose other than tax: no contemporaneous evidence explained why the Israeli company was included, key representatives of the investment fund were not called as witnesses, and the commercial reasons put forward, including centralising marketing and distribution, finding further investments in Israel and defence-export regulation, were not shown to have shaped the structure when it was designed. [src-116]
  - Qualification: Summary of the court's reasoning in a law-firm review of the judgment; the reasoning is the court's.
- Attributed: Relying on Q Cyber's own financial statements, the Assessing Officer raised substantial doubt as to whether Q Cyber was in fact the entity that acquired NSO, or whether the NSO shares were transferred to it only after an agreement had been signed for the Luxembourg company to acquire NSO directly. [src-116]
  - Qualification: The Assessing Officer's argument as reported in a review of the judgment, which the court took into account.
- Documented: On 28 July 2026 the court dismissed the appeal, holding that the payments to the foreign parent company were to be taxed as dividends rather than treated as loan repayments, and ordered Q Cyber to pay the Assessing Officer's costs of NIS 40,000; it cancelled the penalty for failure to withhold tax at source, finding that the circumstances did not justify a finding of fraudulent or false conduct. [src-001] [src-116]
  - Qualification: A district-court judgment; the retained records do not show whether it was appealed.
- Attributed: Omri Lavie, a co-founder and shareholder of NSO, testified for Q Cyber; the judgment describes him as currently the controlling owner of Q Cyber through the chain of companies and, accepting the Assessing Officer's remark, as its sole shareholder with an interest in the outcome. The court described Eran Gorev, Francisco Partners' representative in Israel, as apparently a key figure among the Francisco Partners people who, Lavie testified, designed the transaction; according to Lavie, Gorev negotiated the purchase of the NSO shares and managed Q Cyber on Francisco's behalf shortly after it was set up. Gorev gave a statement to the Assessing Officer but was not called as a witness. [src-001]
  - Qualification: The court's description of the witness; the judgment does not date its "currently". Luxembourg register publications record that Lavie's holding company transferred NorthPole Newco to another person on 8 October 2025 and that in October 2025 Lavie left the boards of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l.
- Documented: The parties told the court that in 2019 Francisco Partners sold its holdings in Q Cyber, and through it in NSO, and that the purchaser later sold them on to one of NSO's original shareholders. [src-001]
  - Qualification: Findings recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.
- Documented: A notice published in Luxembourg's register on 7 November 2025 records that, by decisions of NorthPole Newco's sole shareholder of 8 October 2025, Omri Lavie resigned as manager and Ohad Shazar Shalem Schremer was appointed manager for an indefinite term, and that on 8 October 2025 Dufresne Holding (B275054) transferred all of its shares in NorthPole Newco, 100% of the capital, to Schremer, who became the sole shareholder. [src-035]
- Documented: A notice for OSY Technologies S.à r.l. published on 30 October 2025 records Ohad Shazar Shalem Schremer as a manager from 8 October 2025, the renewal of Anthony Levy's mandate as manager (appointed 15 March 2023), and the removal of Omri Lavie from the board of managers. [src-038]
- Documented: A notice for Q Cyber Technologies S.à r.l. (Luxembourg) published on 28 October 2025 records Ohad Shazar Shalem Schremer as a manager from 8 October 2025, Anthony Michael Levy as manager since 15 March 2023 and delegate for day-to-day management since 5 June 2023, and the removal of Omri Lavie from the board of managers. [src-043]

## The 2019 buyout of NSO by its founders and Novalpina Capital

- Attributed: A press release published by Novalpina Capital on 14 February 2019 announced that NSO Group's management team and founders were acquiring the company from the private equity firm Francisco Partners. The acquisition was led by co-founders Shalev Hulio and Omri Lavie with members of the senior executive team, with a significant number of employees participating, supported by Novalpina Capital as equity partner; Jefferies Group LLC advised and led the financing. The release said NSO had finished 2018 with revenues of $250 million and dozens of licensed customers. [src-009]
  - Qualification: The buyers' own announcement; the revenue figure is the company's.
- Attributed: The WhatsApp complaint of October 2019 states that between 2014 and February 2019 NSO Group obtained financing from a San Francisco-based private equity firm that ultimately purchased a controlling stake, and that in and around February 2019 NSO Group was reacquired by its founders. [src-004]
  - Qualification: Allegation in the plaintiffs' complaint, citing its exhibits.
- Attributed: Francisco Partners told the authors of the 2021 NGO report that on 18 March 2019 OSY Holdings disposed of 100% of its interest in Triangle Holdings and Eran Gorev also sold his entire interest in Triangle. [src-021] [src-066]
  - Qualification: Francisco Partners' own account. A 2023 European Parliament report dates Francisco Partners' sale of its entire interest to Novalpina Capital to 14 February 2019, the date the deal was announced.
  - Outcome: According to Francisco Partners, after that date neither it, its fund, OSY Holdings nor any associated person, including Gorev, retained any ownership or economic interest in NSO Group, and Eran Gorev, Matt Spetzler and Andrew Kowal resigned their director roles.
- Attributed: Accounts of the 2019 terms differ in scope. Israeli business reporting in 2022, based on Tel Aviv court documents, said the deal valued NSO at over $1 billion: Hulio and NSO's management held 30% and Novalpina acquired 70% in a leveraged deal comprising a direct investment of $290 million, $100 million in shares from Hulio and his associates and $400 million of bank loans placed in the holding company controlling NSO. A 2022 news agency report said Novalpina borrowed $500 million for the purchase and placed the debt in the holding company above NSO. The fund's general partner told a New York court in 2025 that the fund acquired the NSO Group for €218.5 million. [src-115] [src-120] [src-106]
  - Qualification: Press accounts and a party's court filing; they describe different components (enterprise value, equity cheque and borrowing) and are not reconciled in the retained records.
- Attributed: According to the 2021 NGO report, after transactions in April 2019 Triangle Holdings owned 31.4% of Square 2 ($22 million of $70 million) and NorthPole Holdco S.à r.l., Novalpina's vehicle, owned 68.6% ($48 million); Square 2 owned 100% of NorthPole Bidco, which owned 100% of NorthPole Newco, which owned 100% of OSY Technologies, and OSY continued to own IOTA Holdings, Q Cyber Technologies S.à r.l., Q Cyber Technologies Ltd and Westbridge Technologies Inc. [src-021]
  - Qualification: Ownership chain as stated by the report from Luxembourg register publications.
- Attributed: Luxembourg register publications summarised by a company-data aggregator record that NorthPole Holdco became a shareholder of Square 2 on 11 April 2019 (capital $70.8 million), that NorthPole Newco, registered on 5 December 2018 as Eighteen Jasmine S.à r.l. and renamed on 31 January 2019, had NorthPole Bidco as its shareholder from 15 April 2019, and that NorthPole Newco replaced Square 2 as OSY's shareholder on 6 May 2019. [src-018] [src-006] [src-005]
  - Qualification: Aggregator summary of register publications; the underlying publications were not retained.
- Documented: Exhibit A to Mercury Public Affairs' registration under the US Foreign Agents Registration Act, received by the Justice Department on 25 December 2019, states that its foreign principal Q Cyber Technologies Ltd is wholly owned by OSY Technologies S.a.r.l., which is wholly owned through multiple intermediate holding companies by Square 2 S.a.r.l.; that Square 2 is about 32% owned by Triangle Holding S.A. and about 68% by North Pole Holdco S.a.r.l.; that NorthPole is wholly owned by Novalpina Capital Partners I LuxCo S.a.r.l., which is 99% owned by Novalpina Capital, the ultimate parent; and that the ultimate parent's general partner is Novalpina Capital Partners I GP S.a.r.l. [src-064]
  - Qualification: The ultimate parent with a general partner is the fund then called Novalpina Capital Partners I SCSp.
- Attributed: According to the 2021 NGO report, the Novalpina Capital Partners I SCSp fund channelled its investments through Novalpina Capital Partners I LuxCo S.à r.l. (incorporated 13 November 2017), and for NSO used NorthPole Holdco S.à r.l. (incorporated in July 2018 and renamed in January 2019), wholly owned by LuxCo; Novalpina Capital Group S.à r.l., owned by Stephen Peel, Stefan Kowski and Bastian Lueken, was the ultimate owner of the fund's general partner, Novalpina Capital Partners I GP S.à r.l. An English High Court judgment of 2025 likewise states that the fund, now NOAL SCSp, was set up in 2017 by Stefan Kowski, Bastian Lueken and Stephen Peel. [src-021] [src-102] [src-075]
  - Qualification: Structure as described by the report.
- Attributed: Luxembourg register publications summarised by a company-data aggregator record that NorthPole Holdco S.à r.l. (register number B226434), originally Eighteen Scabiosa S.à r.l., had Novalpina Capital Partners I LuxCo S.à r.l. as its shareholder and Gaëtan Dumont, Allen Foley and Philip Zarb Mizzi as managers from 30 November 2018, with LuxCo again listed as shareholder in March and June 2019; that Stefano Pileri and Michael Elie Zini became managers in July 2021 and were replaced by Dumont and Foley in August 2021; and that Tamara Makarenko became a manager on 24 February 2022, Dumont and Foley left on 1 March 2022, and James Ward became a manager on 20 October 2022. [src-075]
  - Qualification: Aggregator summary of register publications.
- Attributed: The 2021 NGO report states that the Luxembourg fund Novalpina Capital Partners I SCSp (registered 23 August 2017), used to buy the NSO stake, had commitments above its €1 billion target, and that its limited partners included the Oregon Public Employees Retirement System (18%), the Alaska Permanent Fund Corp. (5.1%), South Yorkshire Pensions Authority (2.7%) and East Riding Pension Fund (1.4%); its general partner was Novalpina Capital Partners I GP S.à r.l., incorporated 18 August 2017. [src-021]
  - Qualification: Percentages of commitments to the fund as reported, not stakes in NSO.
- Attributed: According to the 2021 NGO report, on 19 March 2019 the shareholders of Novalpina Capital Partners I LuxCo resolved that 893,750 class 2 tracking shares would track the investment in NorthPole Holdco, the NSO-linked holding company, and on 8 May 2019 the fund contributed those shares (valued at EUR 32,564,682) and a receivable of EUR 184,465,145, together EUR 217,029,827, to a new company, Novalpina Capital Partners I LuxCo North S.à r.l. [src-021]
  - Qualification: Figures from Luxembourg register minutes as summarised in the report.
- Attributed: Triangle Holdings' articles of 17 April 2019, quoted in the 2021 NGO report, provide that directors nominated by Shalev Hulio and Omri Lavie are class B directors and those nominated by NorthPole Holdco via NorthPole Bidco are class A directors, and that class B directors may represent the company only if the board delegates its powers to them. [src-021]
  - Qualification: Quoted from the articles in the report.
- Attributed: At an extraordinary general meeting of Square 2 on 1 April 2019, according to the 2021 NGO report, Triangle Holdings resigned as sole manager and Stefan Kowski, Stephen Peel, Mickael Betito, Gerhard Schmidt, Zamir Dahbash and Günter Maximilian Schmid were appointed class A managers and Omri Lavie, Shalev Hulio and Yuval Somekh class B managers; at OSY Technologies OSY Holdings Ltd., Eran Gorev and Kevin Wilson were removed and the same class A managers and Lavie and Hulio as class B managers appointed. An aggregator summary of the register dates Gorev's and Wilson's exit from OSY's board to 12 April 2019. [src-021] [src-005]
  - Qualification: Board changes as reported from register minutes and an aggregator summary.
- Attributed: On 30 December 2019, according to Triangle's minutes summarised in the 2021 NGO report, NorthPole Holdco contributed all of its 484,808,020 Square 2 shares, 68.46% of Square 2's capital with a fair market value of USD 247,825,445, to Triangle Holdings in exchange for new class A, B and D shares, making Square 2 a wholly owned subsidiary of Triangle and Triangle the point of connection between Novalpina and NSO; NorthPole Holdco's stake came to about 59.8% of Triangle's class A shares. Register summaries show Triangle replacing NorthPole Holdco as Square 2's shareholder on 27 January 2020. [src-021] [src-018]
  - Qualification: Figures from the minutes as summarised in the report and an aggregator.
- Attributed: The same day Triangle's shareholders appointed Novalpina executives Mickaël Betito, Stefan Kowski, Stephen Peel, Maximilian Schmid Günter and Gerhard Schmidt as class A directors and reclassified Shalev Hulio and Omri Lavie as class B directors; on 27 April 2020 Triangle appointed Asher Levy, named NSO's executive chairman in early April 2020, as a class A director. [src-021]
  - Qualification: Board changes as summarised in the 2021 NGO report.
- Attributed: NSO Group told the report's authors in 2021 that Novalpina, as a shareholder, appointed members to the group boards of Triangle Holdings S.A. and OSY Technologies S.a.r.l. and their committees, which provided strategic direction. [src-021]
  - Qualification: NSO Group's description.
  - Response: NSO Group: Novalpina was not involved in the group's day-to-day operations.
- Attributed: According to the 2021 NGO report, on 30 November 2020 NorthPole Bidco contributed all its shares in Goatilev and NorthPole Newco to Emerald LIE for USD 326,800,326.27 in consideration for 350,000,000 new preferred B shares, and Emerald LIE contributed the same shares to Diamond LIE that day, inserting both companies between NorthPole Bidco and NorthPole Newco; NSO Group said Emerald and Diamond were created to grant stock options to management, directors and employees. Register summaries record Emerald LIE and then Diamond LIE as NorthPole Newco's shareholder from 15 and 17 December 2020. [src-021] [src-006]
  - Qualification: Transaction terms from register minutes as summarised in the report.
  - Response: NSO Group: the two companies exist to grant stock options.
  - Outcome: Register summaries record that Diamond LIE ceased to be NorthPole Newco's shareholder in a publication of 24 February 2023, which records Dufresne Holding in its place; Israeli business reporting attributed that change to the lenders' exercise of their rights under the loan agreements.
- Attributed: On 5 February 2020 NorthPole Bidco acquired Goatilev Ltd., an Israeli shelf company that bought two Israeli companies in February and March 2020; according to the 2021 NGO report Goatilev is reported to have bought Wayout, a company focused on router compromise and interception of Internet of Things data. [src-021]
  - Qualification: The acquisition is quoted from NorthPole Bidco's accounts in the report; Wayout's description is the report's.
  - Response: NSO Group confirmed that Wayout is an NSO Group company developing cyber security products for the IoT world for governmental use.
- Documented: NorthPole Newco's 2024 annual accounts state that on 3 March 2019 its then sole shareholder entered into a credit agreement for a term loan of up to USD 510,000,000 with a six-year maturity and a revolving facility of up to USD 30,000,000, and that under a joinder agreement of 8 April 2019 NorthPole Newco became the borrower and assumed the liability (the "debt pushdown"); the term loan bore interest at the alternate base rate plus an initial margin of 7.00%. [src-061]
- Attributed: In May 2021 Moody's downgraded NorthPole Newco S.à r.l., which it described as the top entity of the restricted group of NSO Group, from B2 to B3, together with its $300 million and €176.96 million senior secured term loans maturing in March 2025 and its $30 million revolving facility maturing in March 2024, with a negative outlook. [src-024] [src-061]
  - Qualification: Rating agency announcement as republished by a human-rights resource centre on 25 May 2021.
  - Outcome: NorthPole Newco's accounts record a forbearance agreement of 31 December 2021 with the lenders after certain events of default.
- Attributed: Israeli business reporting in March 2022 described the roughly $500 million debt from the leveraged loan taken to buy 70% of NSO from Francisco Partners in 2019 as owed entirely by the Luxembourg holding company NorthPole Newco, with estimated annual interest of $65 million; it reported that days after NSO's US blacklisting Moody's cut the rating to Caa2, that a senior source said NSO did not feel exposed because the Israeli company had given no surety for the loan, and that the lenders included three main groups, Credit Suisse and the US hedge funds Senator Investment and Birch Grove Capital, alongside BlackRock, Ellington and Jefferies. [src-115]
  - Qualification: Press account; the lender list is what the publication was told.
  - Response: Birch Grove Capital said it was not commenting; Credit Suisse and Senator declined to comment.

## The fight for control of NSO and Q Cyber, 2021–2023

- Attributed: In July 2021 British press reported that public investors in the private equity fund holding the majority stake in NSO Group, led by the Oregon public pension fund, were in talks to transfer management of the fund to the US consultancy Berkeley Research Group (BRG). According to the fund's general partner, the investors voted by 99% in July 2021 to remove Novalpina as general partner; an English High Court judgment of 2025 records that Treo GP replaced Novalpina Capital Partners 1 GP Sarl as general partner on 27 August 2021. [src-045] [src-097] [src-102]
  - Qualification: Press report and the fund's own statement; the date of replacement is recorded in the English judgment.
  - Response: Novalpina and NSO declined to comment to the British press, and BRG did not immediately respond.
- Attributed: A 2023 European Parliament inquiry report states that on 27 August 2021 BRG took over the private equity fund controlling NSO Group and launched investigations into the lawfulness of NSO's activities and its compliance with the US blacklisting, and that BRG's inquiries of May 2022 were obstructed by NSO Group's management. [src-066]
  - Qualification: The report's account, based on press and NGO sources.
- Attributed: Israeli business reporting in 2022 said that the fund's limited partners, including Centerbridge Partners and the Oregon and Alaska pension funds, sought a manager to prepare the assets for sale; BRG joined NSO's board in September 2021 and by the end of that year controlled the board of Triangle Holdings, where chairman Asher Levy, nominated by Novalpina, was replaced by BRG partner Finbarr O'Connor. In January 2022 Levy told the press he had been appointed to represent Novalpina and was making way for BRG's appointee. [src-115] [src-114] [src-117] [src-011]
  - Qualification: Press accounts.
  - Response: Asher Levy said the end of his chairmanship was unrelated to reports about NSO: he had submitted his resignation when BRG took control in July 2021 and completed his term at the end of the year.
  - Outcome: According to a March 2023 report, BRG's control ended when the new controlling owner replaced the directors down the chain, including those appointed by BRG.
- Documented: A notice published in Luxembourg's electronic register of companies and associations on 4 January 2023 lists Triangle Holdings' class A directors as Finbarr O'Connor and Howard Berkowitz, appointed on 4 October 2021 until the 2026 general meeting, and Gavin Farrell and Jeffrey Dunn, appointed on 14 January 2022 until the 2027 general meeting, all with an address care of a New York law firm. [src-073]
- Attributed: The European Parliament inquiry report, citing press, states that NSO reportedly had revenues of USD 243 million in 2020 but that after the Pegasus Project revelations the lawsuits by Apple and Meta, its US blacklisting, the tightening of Israel's export regime, inquiries in several countries and frictions within the private equity fund behind it led to a severe decline in profit, and that its debt reportedly reached 6.5 times its normal annual revenue at one point. [src-066]
  - Qualification: Figures reported by the press and relayed by the inquiry report; no NSO accounts were retained.
- Attributed: In a 2025 petition to a New York federal court, the fund's general partner stated that in October 2021 NSO acknowledged its precarious financial position and asked for an immediate $10 million cash injection to meet payroll, and that a few days after the funding was provided, on 3 November 2021, NSO Group was put on the US Entity List. [src-106]
  - Qualification: Statement of a party in court papers.
- Attributed: Israeli business reporting in January 2022 said that, at the request of NSO's controlling shareholder BRG, Judge Hagai Brenner of the Tel Aviv District Court appointed a lawyer as temporary trustee of the drone company Convexum, announced as acquired by NSO two years earlier for $60 million; it reported that Convexum had in practice been controlled by Triangle, owned 70% by Novalpina and 30% by NSO's management and employees, and that BRG's court papers put NSO's debts at $460 million and NSO was negotiating a sale to two US investment funds with bids of $1 billion to $1.2 billion. Reporting a year later said the long legal process ended with Convexum's separation from NSO, which NSO's management had opposed. [src-114] [src-060]
  - Qualification: Press accounts of court filings; the debt figure is BRG's.
  - Response: NSO's management opposed the separation of Convexum.
  - Outcome: Convexum was separated from NSO after the proceedings, according to the January 2023 report.
- Attributed: According to court records described in Israeli business reporting in March 2022, the group around Shalev Hulio worked on selling NSO together with Convexum against BRG's position; one offer, from Integrity Partners, proposed injecting $300 million at a valuation of $1 billion to $1.5 billion, leaving the Hulio group 30%, focusing sales on Western democracies and repaying debt by 2029. [src-115] [src-118]
  - Qualification: Press account of court records; the offer did not result in a transaction according to the later ownership record.
  - Response: NSO Group called a January 2022 report of talks with Integrity Partners full of inaccuracies and half-truths, but confirmed it was in talks with US-based funds.
  - Outcome: No such sale took place.
- Attributed: Court documents described in March 2022 reporting show NSO's management declining to give BRG full financial information, saying that disclosure to a foreign investor required approval from the Israeli Defence Ministry's export control body because some of the information was classified; the approval had reportedly not been received. In court papers reported in February 2022, BRG's lawyers said that since the Pegasus Project disclosures the only new potential customer bookings for Pegasus came from "elevated risk customers", while lawyers for NSO's lenders said BRG's approach had shut the company off from new customers and deepened its liquidity crisis. [src-115] [src-120]
  - Qualification: Positions of the parties to the Tel Aviv proceedings as reported by the press.
  - Response: A source familiar with NSO said BRG wanted the company to shut down or stop some of its activities with customers, which NSO said its legal obligations did not allow unless customers misused the system.
- Attributed: According to the European Parliament report, on 25 April 2022 two of Novalpina's former general partners sued BRG in Luxembourg seeking Novalpina's reinstatement as general partner and the suspension of BRG's decisions. A November 2022 press release of the fund's general partner said that on 6 May 2022 the fund and its vehicles had filed a criminal complaint with civil-party joinder against Stefan Kowski, Bastian Lueken and Gerhard Schmidt for abuse of powers, under investigation by an investigating judge. [src-066] [src-097]
  - Qualification: Accounts of the report and of a party's press release; the complaint is an allegation and no outcome of the investigation is recorded in the retained documents.
  - Outcome: The court dismissed the former general partners' demands and BRG remained in charge of the fund; according to the general partner, a Luxembourg judge also rejected Novalpina's expedited attempt to confirm a veto right in November 2022.
- Attributed: In its March 2025 petition in the Southern District of New York (1:25-mc-00133), the general partner TREO NOAL GP said that the fund's investment in NSO Group is the subject of proceedings in the Commercial Court of England and Wales against Novalpina's founders claiming damages for conspiracy, among other things, and sought discovery from the law firm Weil, Gotshal & Manges for Luxembourg proceedings; US legal press reported in 2025 that the fund's 2021 financial difficulties and its founders' falling-out were the subject of litigation in Luxembourg. [src-105] [src-106]
  - Qualification: Statements of a party and of the press; the claims are unadjudicated in the retained records.
  - Response: The defendants filed defences to the English claim in January 2025, according to the petition's exhibit list.
- Attributed: US legal press reported in October 2025, citing British business press and court documents, that Weil Gotshal partner Gerhard Schmidt invested €5 million in Novalpina Capital in 2017 without the usual fees and chaired it, advised Novalpina on the NSO deal and sat on the board of the holding company that oversaw NSO's operations; according to the court filing he "would have been voting" when NSO's oversight board took steps to renew Saudi Arabia's access to Pegasus after the murder of Jamal Khashoggi, access that two people familiar with the matter said was restored by mid-2019. In April 2019 a coalition of NGOs had written to Novalpina questioning the independence of Schmidt, reportedly non-executive chairman and director of Novalpina Capital Group S.à r.l., as part of its legal compliance team. [src-105] [src-108]
  - Qualification: Press and NGO accounts; the voting statement comes from a party's court filing and the Saudi access account from unnamed sources.
  - Response: NSO said in a statement that it complies fully with all applicable laws and regulations and sells its technologies exclusively to vetted intelligence and law enforcement agencies.
- Attributed: In January 2023 Q Cyber Technologies sued in the Tel Aviv District Court BRG, the parent companies, the syndicate of lenders and the founders Shalev Hulio and Omri Lavie, asking the court to declare who its board of directors is, whether the appointments of Tamara Makarenko and Asher Alan Bornstein, named by BRG, were valid, and whether a board decision of 29 December 2022 requiring the company to hand over information and documents was valid; it also sought urgent interim relief preserving the position before the new directors' appointment. Q Cyber said that it and its management took no position on the merits of the dispute between the defendants but faced serious consequences if they complied with decisions later found unlawful. [src-060] [src-011]
  - Qualification: Account of Q Cyber's statement of claim in Israeli business reporting of January 2023; the case number is not given in the retained documents.
  - Outcome: A notice filed in the proceeding in February 2023 informed the court that the lenders had exercised their rights under the loan agreements; according to a March 2023 report, the new controlling owner then replaced the directors down the chain, including those appointed by BRG. No ruling on the claim is recorded in the retained documents.
- Attributed: According to Q Cyber's claim, a Luxembourg court ruled in December 2022, in a dispute among Novalpina's directors, that acts of directors appointed by Novalpina between August and December 2021 were void, after which BRG moved to appoint Tamara Makarenko and Asher Alan Bornstein as directors of the group companies; on 16 December 2022 the minority shareholders Hulio and Lavie wrote that the new directors' decisions were invalid, and on 29 December the syndicate of lenders, which had lent the group about half a billion dollars, also questioned their legitimacy. The new directors held the board meeting on 29 December regardless and demanded commercially sensitive documents; Makarenko declined to produce the decision appointing her and relied on an opinion of English counsel. [src-060]
  - Qualification: Q Cyber's account in its claim as reported by the press; the Luxembourg ruling itself was not retained.
- Attributed: Responding to Q Cyber's interim relief request on 22 January 2023, some respondents, including the controlling fund's side and its appointed directors, asked the court to reject it, alleging bad faith. They argued that Shalev Hulio, although he formally resigned as chief executive in August 2022 and left the board, remained extensively involved in decision-making through the current chief executive Yaron Shohat, and that because management concealed its actions the company might be selling its products, described as offensive cyber weapons, to problematic or high-risk customers. They added that Hulio had attended the disputed board meeting without protest and voted on the proposals. [src-048]
  - Qualification: Allegations made by respondents in court papers, as reported by Israeli business press on 23 January 2023; not findings of the court.
  - Response: NSO said in response: "Our request for declaratory relief is our response."
- Attributed: Luxembourg register publications summarised by a company-data aggregator record Tamara Makarenko as a manager of NorthPole Newco from 22 December 2021 (replacing Gaëtan Dumont and Allen Foley) until 4 January 2022, Anthony Levy as a manager from 24 December 2021, and Asher A. Bornstein and Tamara Makarenko as managers from 29 December 2022; on 20 January 2023 Anthony Levy left. [src-006]
  - Qualification: Aggregator summary of register publications.
- Documented: The UK Companies House record of Triangle Holdings S.A. as an overseas company (FC040779) lists eight active directors, each shown as appointed on 1 August 2023: Howard Samuel Berkowitz, Jeffrey Robert Dunn, Gavin Brian Farrell and Finbarr Timothy O'Connor, with a New York correspondence address; Tamara Makarenko and James Ward; and NSO's founders Shalev Holy (Hulio) and Omri Lavie. [src-124]
  - Qualification: The date is the appointment date in the UK overseas-company record; Luxembourg notices give earlier appointment dates for some of the same directors.

## Who has controlled NSO and Q Cyber since 2023?

- Attributed: Israeli business reporting on 1 March 2023 said that the syndicate of lenders that had lent about half a billion dollars for the buyback from Francisco Partners exercised its rights under the loan agreements: the shares of NSO's Luxembourg parent NorthPole, until then held by a holding company called Diamond and pledged to the lenders, were transferred directly to Dufresne Holdings, a holding company created in Luxembourg in January 2023. According to the Luxembourg register as of 10 February, Dufresne had one shareholder and one director, Omri Lavie, and the new controlling owner replaced the directors throughout the chain, including those appointed by BRG, pending the entry of a new group of investors. [src-011]
  - Qualification: Press account of a notice filed in Q Cyber's Tel Aviv proceedings and of the Luxembourg register; the report calls OSY NSO's Israeli parent, whereas the Israeli parent is Q Cyber.
  - Response: NSO did not respond to the publication. A spokesperson for TREO NOAL GP, general partner of the fund, said the lenders, who had exercised effective control over NSO for the past 15 months, had seemingly organised a foreclosure after NSO failed to meet its financial obligations since 2021, that the fund had been denied basic corporate information including on compliance with US law and sales to elevated-risk customers, and that the fund's investment had been and remained valueless.
- Attributed: Luxembourg register publications summarised by a company-data aggregator record that Dufresne Holding S.à r.l. (register number B275054) was registered on 27 January 2023 with capital of €12,000 and Omri Lavie as manager and one shareholder; that a publication of 24 February 2023 records it in place of Diamond LIE as NorthPole Newco's shareholder; that a publication of 16 March 2023 lists Robert Bruce Simonds and Omri Lavie as its managers and one of 17 August 2023 records that Simonds ceased to be a manager; that Lavie was listed as manager and partner in 2023 and 2024; and that a publication of 17 August 2026 again lists Lavie as manager and member of the executive board, with one shareholder. [src-007] [src-006] [src-018] [src-035]
  - Qualification: Aggregator summary of register publications; its dates are publication dates, and NorthPole Newco's accounts date the new shareholder's pledge and Lavie's appointment as manager to 17 February 2023.
- Documented: NorthPole Newco's 2024 accounts record that on 17 February 2023 all shares held by its new shareholder were pledged to Wilmington Trust (London) Limited as collateral agent, and that after the "appropriation" the lenders agreed on 16 March 2023 to the change of control of the company and its subsidiaries and extended a super-priority loan of USD 5,000,000; the accounts list Omri Lavie as a manager from 17 February 2023 and Anthony Levy from 15 March 2023, with the same two managers at OSY Technologies. [src-061] [src-062]
- Attributed: A company-data aggregator's page for Omri Lavie, summarising Luxembourg register publications, lists him as a manager of OSY Technologies and Q Cyber Technologies S.à r.l. in publications of 23 February 2023 and of NorthPole Newco in one of 24 February 2023, which also records Dufresne Holding in place of Diamond LIE as NorthPole Newco's shareholder; in each company Anthony Levy appears beside him as a manager from March 2023, and publications of August 2024 still list both. [src-018]
  - Qualification: Aggregator summary of register publications.
- Attributed: Reporting in August 2023 stated that since February 2023 NSO's controlling shares had been held by Dufresne Holding in Luxembourg after NSO's creditors, including Credit Suisse, Senator Investment Group and Birch Grove Capital, took the shares and transferred them to a new holding company owned solely by founder Omri Lavie, and that the company still carried about half a billion dollars of debt from the buyback from Francisco Partners. [src-091]
  - Qualification: Press account.
- Attributed: According to Israeli business reporting, Hollywood producer Robert Simonds, founder of STX Entertainment, joined the board of the holding company shortly after the 2023 transfer, at the lenders' initiative to raise financing; he tried to acquire NSO in June 2023. The August 2023 report suggested he may have been forced out for lack of Israeli Defence Ministry approval, possibly because of business ties to China. [src-013] [src-091]
  - Qualification: The reasons for his departure are the publication's speculation, not a recorded decision of the ministry.
  - Outcome: He left the board in August 2023 after five months, when the acquisition attempt had failed.
- Attributed: On 10 October 2025 NSO spokesperson Oded Hershowitz told a US technology publication that "an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership", adding that the headquarters and core operations remained in Israel under Israeli supervision including the Ministry of Defense. Israeli business reporting the same day said the group was led by Robert Simonds, that the deal was valued at several tens of millions of dollars and expected to include the divestment of NSO's roughly $500 million debt, that completion required approval from the Defence Ministry's export control agency, and that Omri Lavie's involvement would end. [src-012] [src-013] [src-035]
  - Qualification: The investors and terms were not disclosed; the company's spokesperson later declared his comments off the record, according to the publication.
  - Response: The spokesperson declined to name the investors or the amount invested; Lavie did not immediately comment, and neither Simonds nor STX Entertainment responded to the publication's request for comment.
  - Outcome: Luxembourg register notices record that on 8 October 2025 Dufresne Holding transferred all of NorthPole Newco's shares to Ohad Shazar Shalem Schremer, who replaced Lavie as its manager. The retained documents do not name the investors or record the export control agency's decision.
- Attributed: Israeli press reported in November 2025 that a group of US investors led by Robert Simonds had bought a controlling stake in NSO in October 2025 and that NSO's founders, Niv Karmi, Shalev Hulio and Omri Lavie, were no longer shareholders. [src-027]
  - Qualification: Press account; the investors other than Simonds were not named.
- Attributed: Israeli business reporting in November 2025 said that the change of control took place through the purchase of the company's debt by a new group whose members were not published, which led to Lavie's removal and Friedman's appointment, and that Luxembourg filings of late October and early November named Ohad Shazar Shalem Schremer, a lawyer, as a director of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l. [src-050]
  - Qualification: Press account; the debt purchase itself is not shown in the retained register notices.
- Documented: A register notice published on 22 December 2025 records that on 8 December 2025, by realisation of a pledge followed by a private sale, all of NorthPole Newco's shares held by Ohad Shazar Shalem Schremer, four classes representing 100% of the capital, were transferred to Hippocrene Ventures LLC, a Delaware limited liability company registered under number 10338240, which became the sole shareholder. [src-034]
  - Qualification: The notice does not name the pledgee.
- Documented: A register notice published on 26 February 2026 records that under a share purchase agreement of 30 December 2025 Hippocrene Ventures LLC sold all of NorthPole Newco's shares (559,737,894 class A and 558,376,950 each of classes B, C and D, 100% of the capital) to Ohad Shazar Shalem Schremer, who became the sole shareholder with effect from 30 December 2025. [src-033]
- Attributed: Luxembourg business press reported in April 2026 that Omri Lavie had been removed as a director of three key Luxembourg entities within ten days, Q Cyber Technologies on 28 October 2025, OSY Technologies on 30 October and NorthPole Newco on 7 November, and that on 30 December 2025 Hippocrene Ventures LLC transferred NorthPole Newco's entire share capital to an individual; it added that on 26 February 2026 NorthPole Newco recorded a further change in shareholding and in its legal form. An aggregator summary of the register shows a change of shareholders on 26 February 2026. [src-015] [src-006]
  - Qualification: The dates the publication gives for Lavie's removal are the publication dates of the register notices, which record 8 October 2025 as the effective date. The register notice published on 26 February 2026 is the one recording the 30 December 2025 sale; no retained document shows a later owner or the change of legal form.
- Documented: According to his witness biography published by the US House of Representatives, former US ambassador to Israel David M. Friedman was appointed on 10 November 2025 executive chairman of the Luxembourg holding company that owns NSO Group and of a Delaware subsidiary of that company; a register notice published on 30 December 2025 records his appointment as a manager of OSY Technologies with effect from 15 December 2025. [src-016] [src-037]
  - Qualification: The biography does not name the companies.
- Attributed: NSO Group's transparency report for 2025 states that in 2025 the group entered a new phase following a change in ownership and the appointment of David Friedman as executive chairman of its holding company; press in January 2026 reported that chief executive Yaron Shohat had also stepped down and that Omri Lavie, the last founder still involved, had left. [src-084] [src-080]
  - Qualification: The company's report does not name the new owners.
- Attributed: In an interview reported in November 2025, Friedman said he would make the case to the Trump administration that NSO's technology could help make Americans safer and would seek to sell its products to US law enforcement agencies, that "the NSO of today is a far more careful company in how it licenses its technology than it was five six years ago", and that "this change of control and ownership brings with it sufficient capital to maintain the business". [src-027]
  - Qualification: Statements of the executive chairman.

## The Luxembourg companies around Q Cyber and their finances

- Attributed: Q Cyber Technologies S.à r.l. is a separate Luxembourg company from Q Cyber Technologies Ltd: according to Luxembourg register publications summarised by a company-data aggregator it was registered on 8 January 2016 (register number B203124) with capital of €12,500, OSY Technologies as shareholder and Eran Gorev, Yuval Somekh and K. Wilson as managers. A publication of May 2019 lists its legal form as société à responsabilité limitée and its name as Q Cyber Technologies; on 20 August 2019 Charline de Maigret and "Shalev Holy" became managers and Eran Gorev and Kevin Wilson left, and Yuval Somekh was again listed as a manager on 10 September 2019. [src-010]
  - Qualification: Aggregator summary of register publications. "Shalev Holy" is the spelling under which Shalev Hulio appears in Luxembourg and UK records.
- Attributed: Aggregator summaries of register publications list a word mark "Q Cyber Technologies" (16 May 2017) and a word-figurative mark "Q" (20 October 2016) under OSY Technologies, together with OSY's shareholding in Q Cyber Technologies. [src-005]
  - Qualification: Aggregator listing; the trade mark registers themselves were not retained.
- Attributed: According to a company-data aggregator's summary of the Luxembourg register, OSY Technologies S.à r.l. is registered under number B184226 (European unique identifier LURCSL.B184226) with LEI 222100KKW3GGPGATJ296, has its address at 44 rue de la Vallée, L-2661 Luxembourg, and is classified under NACE code 64.99, other financial service activities. [src-005]
  - Qualification: Aggregator summary of the register; the register number also appears in the company's own Israeli filings and its accounts.
- Attributed: Luxembourg register publications summarised by the same aggregator record further changes on OSY Technologies' board of managers: Asher Levy as a manager from 17 September 2020 until 4 January 2022; the departure of Gerhard Schmidt on 25 August 2021, Stephen Peel on 13 September 2021, Mickael Betito and Stefan Kowski on 20 September 2021 and Yuval Somekh on 4 November 2021; Anthony Levy as a manager from 7 December 2021; Omri Lavie as a manager from 23 February 2023, when five managers left, joined by Anthony Levy on 17 March 2023; a notice of 30 October 2025 removing Lavie's entry as manager and naming Anthony Michael Levy as manager; and David M. Friedman as manager and member of the executive board in a notice of 30 December 2025. [src-005]
  - Qualification: Dates are those of the register publications as listed by the aggregator, not necessarily the dates of the underlying decisions.
- Attributed: NSO Group told the authors of the 2021 NGO report that Q Cyber Technologies S.à r.l. acts as commercial distributor for the products of the group companies: it signs contracts, issues invoices and receives payments from group customers, which form the basis of its reported income; it does not export group products and has not sought an export licence in Luxembourg. The report gives its net turnover from the sale and distribution of computer equipment and services as USD 24,738,462 in 2016, USD 82,651,201 in 2017, USD 169,214,909 in 2018 and USD 229,839,361 in 2019. [src-021]
  - Qualification: NSO Group's description; turnover figures as quoted from the company's accounts in the report.
  - Response: NSO Group: the Luxembourg company does not export group products.
- Attributed: Luxembourg business press reported in August 2022, based on financial filings, that NSO Group had booked most of its sales over the previous two years in Luxembourg. [src-029]
  - Qualification: Only the headline and summary of the article were retained.
- Attributed: Figures summarised by a Luxembourg company-data site from Q Cyber Technologies S.à r.l.'s filed accounts show net income of $9.28 million (2022), $10.1 million (2023), $7.98 million (2024) and $7.66 million (2025), and equity falling from $27.3 million (2022) to $10.4 million (2023) and $4.89 million (2024) before rising to $6.04 million (2025). [src-042]
  - Qualification: Rounded figures from an aggregator.
- Documented: OSY Technologies' 2024 accounts record dividends from Q Cyber Technologies S.à r.l. of USD 13,500,000 in 2024 and USD 27,000,000 in 2023, and a short-term loan owed by OSY to Q Cyber Technologies S.à r.l. with a principal of USD 163,680,016 at the end of 2024 (USD 197,840,966 in 2023), drawable up to USD 300,000,000 and extended in June 2023 to 30 June 2025. [src-062]
  - Qualification: Luxembourg press reported the two years' dividends together as $40.5 million.
- Documented: OSY Technologies' 2024 accounts show negative equity of USD 272,166,845 and a loss of USD 2,809,165 for 2024; a term loan of USD 114,548,695 owed to NorthPole Newco, originally a USD 258,549,810 loan of the term-loan proceeds made on 18 March 2019; and four full-time-equivalent staff. They omit details of companies in which OSY holds at least 20% as "seriously prejudicial" to them, while putting the fair market value of its subsidiaries at USD 842,000,000 under an internal valuation of November 2020. [src-061] [src-062]
- Attributed: A Luxembourg company-data site summarising OSY's filed accounts shows net income of $3.9 million (2021), -$9.39 million (2022), $7.4 million (2023) and -$2.81 million (2024), and equity of -$267 million to -$277 million in each year from 2021 to 2024. [src-036]
  - Qualification: Rounded aggregator figures.
- Documented: According to OSY's 2024 accounts, on 1 December 2014 IOTA Holdings Limited issued a promissory note of USD 94,000,000 at 4% to its former shareholder in connection with the acquisition of IOTA's subsidiaries; OSY paid the amount due to IOTA's former shareholder in 2015, and an amended note transferred the former shareholder's rights under it to OSY, which carries it as a loan to IOTA with a principal of USD 116,063,116 at the end of 2024. [src-062]
- Documented: OSY's 2024 accounts also record a revolving credit facility of up to USD 2,000,000 at 3% granted to Gideon Cyber Systems LLC under an agreement of 31 January 2022 effective from 31 August 2021 (principal USD 1,802,000 at the end of 2024), and a facility to Westbridge Technologies, Inc. with a principal of USD 1,589,854. [src-062]
  - Qualification: The accounts list the Gideon facility among other debtors, not among affiliated undertakings, and do not describe Gideon's business.
- Documented: OSY's 2024 accounts record share pledges to Wilmington Trust (London) Limited over its equity interests in Westbridge Technologies, Inc. (8 April 2019, New York law), over OSY itself granted by NorthPole Newco (8 April 2019), over the shares it holds in an unnamed affiliated undertaking (17 May 2022, Israeli law) and over its shares in Iota Holdings Limited (17 May 2022, Cypriot law); NorthPole Newco's accounts record a first-ranking pledge of all OSY shares to Wilmington Trust as collateral agent under an agreement of 14 March 2019. [src-062] [src-061]
  - Qualification: The Israeli-law pledge does not name the affiliated company; Q Cyber Technologies Ltd is the Israeli company that OSY is recorded as owning.
- Documented: NorthPole Newco's 2024 accounts, filed on 29 July 2025, show amounts owed to credit institutions of USD 713,118,477 (USD 638,678,345 a year earlier) within total creditors of USD 746,156,153, a 2024 loss of USD 79,516,731.27 carried forward to an accumulated deficit of USD 322,449,975.86, term-loan principal of USD 440,073,128 with accrued interest of USD 177,532,472, and its 100% holding in OSY at a book value of USD 550,885,976 against an internal November 2020 valuation of USD 873,963,000. [src-061]
- Documented: NorthPole Newco's accounts record a forbearance agreement dated 31 December 2021 among Westbridge Technologies, Inc. and NorthPole Newco as borrowers, the lenders and Wilmington Trust (London) Limited as collateral agent, under which the lenders agreed to forbear from enforcement after certain events of default; the borrowers agreed a forbearance fee of USD 23,823,127, and in January 2022 NorthPole Newco paid USD 924,303 to terminate a currency swap with Jefferies Structured Credit LLC. [src-061]
- Attributed: A Luxembourg company-data site summarising NorthPole Newco's filed accounts shows net losses of $45.6 million (2021), $37 million (2022), $86.8 million (2023) and $79.5 million (2024), with equity falling from $208 million (2021) to $4.35 million (2024); Luxembourg press in April 2026 described the 2024 accounts as showing bank debt of $713 million at NorthPole Newco and negative equity at OSY. [src-032] [src-015]
  - Qualification: Aggregator and press summaries; the press gave OSY's negative equity as €272 million, whereas OSY's accounts state USD 272,166,845.
- Attributed: Triangle Holdings SA is registered in Luxembourg under number B192115 with LEI 54930042RZ0X284GK323, as a holding company. A company-data site summarising its accounts shows equity of $273 million for 2019 and 2020 and negative equity of $4.32 million for 2022, with a 2022 net loss of $4.57 million. [src-074] [src-072] [src-017]
  - Qualification: Identifiers and financial figures from aggregator summaries; the office move is from an official notice.
  - Outcome: A register notice records that its registered office moved on 4 July 2023 from 2 rue Edward Steichen to 15 boulevard Friedrich Wilhelm Raiffeisen, Luxembourg, the address company-data sites still gave in October 2026.
- Attributed: UK branch registrations of Triangle Holdings and Square 2, as summarised by a company-data aggregator, record petitions to wind up on 2 May 2024; the summaries do not name the petitioner. [src-017] [src-095]
  - Qualification: Aggregator summaries of UK publications concerning the UK establishments of the two Luxembourg companies; the Luxembourg companies continued to file accounts, Square 2 most recently for 2023 in October 2026.
  - Outcome: Winding-up orders followed on 30 May 2024 and liquidators were appointed in June 2024; progress reports in a winding up by the court were published in 2025 and 2026.
- Attributed: Luxembourg press reported in April 2026 that at least seven NSO-affiliated entities remained active or had recently been active in the Luxembourg register, all at 44 rue de la Vallée: Dufresne Holding (B275054), NorthPole Newco (B230411), OSY Technologies (B184226), the Luxembourg Q Cyber Technologies, NorthPole Bidco, Triangle Holdings (B192115) and Square 2. [src-015]
  - Qualification: Press account; Triangle's own register notice of July 2023 gives a different registered office.

## WhatsApp and Meta v. NSO Group and Q Cyber Technologies

- Attributed: On 29 October 2019 WhatsApp Inc. and Facebook, Inc. sued NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. in the US District Court for the Northern District of California, alleging that between about April and May 2019 the defendants used WhatsApp servers in the United States and elsewhere to send malware to approximately 1,400 mobile phones, whose users, according to the complaint, included attorneys, journalists, human rights activists, political dissidents, diplomats and senior foreign government officials. The complaint relied on Israeli register records to describe Q Cyber as NSO's sole active director and majority shareholder and OSY Technologies as Q Cyber's sole shareholder and director. [src-004] [src-030] [src-026] [src-057] [src-056]
  - Qualification: Allegations in the complaint.
  - Response: The defendants argued that they were entitled to immunity because they acted for foreign governments, that Pegasus was marketed only to and used only by sovereign governments, and that their role was limited to advice and technical support in setting up, not operating, the technology; the district court and, in November 2021, the Ninth Circuit rejected the immunity defence.
  - Outcome: The court later granted partial summary judgment on liability; the jury's punitive award of May 2025 was remitted to $4,002,471 in October 2025, a permanent injunction and final judgment followed on 12 November 2025, and the defendants appealed.
- Documented: The court clerk entered default against NSO Group Technologies Limited and Q Cyber Technologies Limited on 2 March 2020; on 25 March 2020 Judge Phyllis J. Hamilton granted in part the defendants' motion to set the default aside and denied the plaintiffs' motion for alternative service. The defendants' filings in March and April 2020 included declarations of Shalev Hulio. [src-030]
- Documented: On 2 April 2020 NSO Group Technologies Limited and Q Cyber Technologies Limited moved to dismiss the case under Federal Rules of Civil Procedure 12(b)(1), (2), (6) and (7). In their certificate of interested entities filed in May 2020, the two companies identified NSO Group Technologies Limited and OSY Technologies SARL as corporate parents. The US Department of Justice filed sealed exhibits and a declaration of a DOJ attorney in connection with WhatsApp's motion to disqualify defence counsel. [src-030]
- Documented: On 8 November 2021 the US Court of Appeals for the Ninth Circuit (No. 20-16408) affirmed the district court's denial of NSO Group Technologies Limited's and Q Cyber Technologies Limited's motion to dismiss on grounds of foreign sovereign immunity. The opinion recorded NSO's assertion that its customers include the Kingdom of Bahrain, the United Arab Emirates and Mexico and that its product is used only by sovereign governments. [src-026]
  - Qualification: The customer list is NSO's own assertion recorded by the court, not a finding.
- Documented: NSO Group Technologies Limited and its co-petitioners asked the US Supreme Court to review the Ninth Circuit decision (No. 21-1338, petition filed 6 April 2022); the Court invited the Solicitor General to express the views of the United States and denied the petition on 9 January 2023. [src-052]
- Documented: According to the district court's order of 17 October 2025, the court had granted partial summary judgment for the plaintiffs on liability under the Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act and for breach of contract; the evidence showed that the defendants reverse-engineered WhatsApp's code to create a modified client application and used it to install their software on target users' devices through WhatsApp's servers. [src-057]
- Documented: On 6 May 2025 a jury unanimously awarded WhatsApp and Meta the full $444,719 in compensatory damages they sought, found that the defendants acted with malice, oppression or fraud, and awarded $167,254,000 in punitive damages; NSO Group Technologies Limited and Q Cyber Technologies Limited moved for a new trial on 29 May 2025. [src-056] [src-057]
- Documented: In its order of 17 October 2025 the court held that the punitive award could not exceed a 9:1 ratio and remitted it to $4,002,471, granting the defendants' motion to that extent; WhatsApp and Meta filed a notice accepting the remittitur on 31 October 2025. [src-057] [src-056]
- Documented: The same order found that the defendants' conduct caused irreparable harm and that there was no dispute that it was ongoing, citing the August 2024 testimony of NSO's chief executive Yaron Shohat, and granted a permanent injunction; it directed the plaintiffs to exclude the defendants' sovereign government customers, which were not parties, from its scope. The injunction order and final judgment were entered on 12 November 2025. [src-056] [src-057]
  - Qualification: The order does not name the sovereign customers.
- Documented: NSO Group Technologies Limited and Q Cyber Technologies Limited appealed to the Ninth Circuit on 19 November 2025 (USCA No. 25-7380) and moved to stay the injunction; Judge Hamilton denied a stay on 19 December 2025 while extending an administrative stay by 45 days, and the Ninth Circuit denied a stay on 28 January 2026. On 30 January 2026 the court granted the plaintiffs' motion for attorney's fees, which the defendants appealed on 11 February 2026 (USCA No. 26-874); the district court case was terminated on 2 February 2026. [src-031] [src-030] [src-056]
  - Qualification: The retained records do not show the outcome of the appeals.
- Documented: After judgment, Meta Platforms and WhatsApp pursued discovery in aid of enforcement and on 8 June 2026 moved to hold the defendants in contempt; on 16 October 2026 Judge Hamilton denied the contempt motion and issued an order on post-judgment discovery disputes. [src-031]
- Attributed: In their response and objection to the plaintiffs' proposed injunction order, filed on 4 November 2025, NSO Group Technologies and Q Cyber Technologies argued that it was reasonably foreseeable that a US law enforcement or intelligence agency would use Pegasus and that an injunction limiting its use could hinder government operations in a crisis; a footnote stated that in 2018 the FBI licensed the use of Pegasus and the CIA assisted Djibouti in obtaining a Pegasus licence, citing a sealed exhibit (Dkt. 616-2). [src-081] [src-077] [src-085]
  - Qualification: Statements of the defendants in court papers; the exhibit cited was filed under seal.
- Documented: Among the declarations filed for the defendants were those of Yifa Idisis, attached to an opposition of 20 March 2025, and of NSO's chief executive Yaron Shohat, whose testimony the court cited. [src-085] [src-057]
- Documented: Third parties Westbridge Technologies, Josh Shaner and Terrence DiVittorio filed a motion for clarification in the WhatsApp case, which WhatsApp and Meta opposed. [src-056]
  - Qualification: Only the docket description was retained; the motion's content is not described.

## Other US suits against NSO and Q Cyber: Apple, El Faro and Khashoggi

- Documented: Apple Inc. sued NSO Group Technologies Limited and Q Cyber Technologies Limited in the Northern District of California on 23 November 2021 (Apple Inc. v. NSO Group Technologies Limited, 3:21-cv-09078, Judge James Donato). In a certificate of interested entities filed in February 2022 the defendants identified OSY Technologies as their corporate parent, and on 3 March 2022 they moved to dismiss. [src-046]
- Documented: The Apple case was stayed in 2022 pending the Supreme Court's decision on NSO's petition in the WhatsApp case; a later order of the same court records that it rejected NSO's forum non conveniens challenge in the Apple case in January 2024. On 13 September 2024 Apple moved to dismiss its own suit voluntarily under Rule 41(a)(2), NSO Group Technologies and Q Cyber Technologies responded, and on 12 November 2024 Judge Donato issued an order on the voluntary dismissal and sealing, terminating the case. [src-046] [src-047] [src-053]
  - Qualification: The terms of the order on voluntary dismissal are not described in the retained docket entries.
- Documented: Journalists of the Salvadoran digital newspaper El Faro sued NSO Group Technologies Limited and Q Cyber Technologies Limited in the Northern District of California on 30 November 2022 (Dada v. NSO Group Technologies Limited, 3:22-cv-07513, Judge James Donato), alleging that Pegasus was used against their iPhones; an amended complaint followed in December 2022 and the case was related to the Apple case. The defendants' motion to dismiss of April 2023 was supported by declarations of Roy Blecher and NSO's chief executive Yaron Shohat. [src-046] [src-049] [src-054]
- Documented: On 8 March 2024 Judge Donato dismissed the El Faro journalists' suit on the ground of forum non conveniens, accepting NSO's argument that the case involved foreign plaintiffs, foreign defendants and foreign conduct, and closed the case; the order notes the complaint's statement that virtually all of the attacks occurred in El Salvador in connection with news stories the plaintiffs were covering there. [src-053] [src-049]
- Documented: On appeal (Nos. 24-2179 and 24-3463), the Ninth Circuit in an unpublished memorandum of 8 July 2025, with Judge Bade dissenting, vacated the forum non conveniens dismissal and remanded; the court described Pegasus as a spyware system developed and deployed by NSO Group Technologies Limited and Q Cyber Technologies Limited, both incorporated in Israel, as alleged by the plaintiffs. [src-054]
- Documented: After remand the defendants renewed their motion to dismiss in September 2025. On 30 September 2026 Judge Donato granted the motion for lack of personal jurisdiction, dismissed the complaint without prejudice, refused further leave to amend and entered judgment against the plaintiffs; the order describes the gravamen of the claims as NSO supplying spyware to an unnamed government outside the United States to access the Apple iPhones of plaintiffs working for a newspaper in El Salvador. [src-047] [src-055] [src-067]
  - Qualification: The court did not identify the government; NSO stated in a declaration that all its employees with relevant knowledge reside in Israel.
- Documented: On 15 June 2023 Hanan Elatr Khashoggi, the widow of journalist Jamal Khashoggi, filed a seven-count complaint in the Eastern District of Virginia (1:23-cv-779) against NSO Group Technologies Limited and Q Cyber Technologies Limited, alleging that their spyware was used by agents of the governments of Saudi Arabia and the United Arab Emirates to obtain information from two of her phones that was used in the surveillance and assassination of her husband. On 26 October 2023 Judge Leonie M. Brinkema granted the defendants' motion to dismiss with prejudice, addressing only the jurisdictional arguments. [src-058] [src-051]
  - Qualification: The allegations about the use of the spyware are the plaintiff's; the court decided only jurisdiction.
  - Outcome: A litigation tracker kept by an academic research group reports that the Fourth Circuit dismissed her appeal in May 2025 for lack of jurisdiction.
- Attributed: As summarised in the Virginia memorandum, the complaint described NSO Group as a subsidiary of Q Cyber, a private company also incorporated in Israel, alleged that founder Omri Lavie runs both companies, and called Westbridge Technologies, Inc. an NSO subsidiary headquartered in Virginia formed for US sales; the defendants argued that Westbridge is not a subsidiary of NSO Group but a corporate affiliate owned by the same ultimate parent company. [src-058]
  - Qualification: Allegations of the plaintiff and the defendants' answer as recited by the court.
  - Response: The defendants: Westbridge is an affiliate under the same ultimate parent, not an NSO subsidiary.
  - Outcome: The court noted that the complaint did not allege that Westbridge was involved in surveilling the plaintiff, and dismissed the case on jurisdictional grounds.

## Proceedings in Spain, Israel, France, the UK and Thailand

- Attributed: In May 2022 Gonzalo Boye, a lawyer for Catalan politicians whom the European Parliament inquiry report describes as a Pegasus target, brought a case in Madrid on behalf of at least 19 targets against NSO, its three founders Niv Karmi, Shalev Hulio and Omri Lavie, Q Cyber Technologies and OSY, which the European Parliament inquiry report describes as a subsidiary based in Luxembourg; a research group's litigation tracker describes the defendants as NSO, Q Cyber Technologies, a subsidiary in Luxembourg, OSY and senior officers of these businesses. [src-066] [src-051]
  - Qualification: The sources do not say whether the Israeli company Q Cyber Technologies Ltd or the Luxembourg company Q Cyber Technologies S.à r.l. was named; no outcome is recorded in the retained documents.
- Attributed: Luxembourg press reported in April 2026 that in March 2025 a court in Barcelona placed three NSO executives, Shalev Hulio, Omri Lavie and Yuval Somekh, under investigation in the "Catalangate" case for their roles in the Luxembourg companies OSY Technologies and Q Cyber Technologies Luxembourg, the first such step against NSO executives in Europe, and sought Luxembourg's cooperation through a European Investigation Order. [src-015]
  - Qualification: Press account of a criminal investigation; being placed under investigation is not a charge or a finding, and no later stage is recorded in the retained documents.
- Attributed: Spain's High Court opened its own investigation after the Spanish government stated that Pegasus had been used against ministers including Prime Minister Pedro Sánchez, and in June 2022 called NSO Group's chief executive to testify as a witness; according to the litigation tracker, in 2025 the association Sentinel Alliance filed a case in Barcelona against Spain's intelligence centre, the Civil Guard, NSO Group and Candiru. [src-066] [src-051]
  - Qualification: NSO's chief executive was called as a witness, not as a suspect. Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained.
  - Outcome: According to the litigation tracker, the High Court investigation was shelved in July 2023, the judicial authorities citing Israel's lack of cooperation, and was reportedly reopened in 2024; no outcome of the 2025 Barcelona case is recorded.
- Attributed: According to the litigation tracker, in September 2024 four individuals filed a criminal complaint in the United Kingdom accusing three companies of violating UK laws: NSO Group, its parent company the Luxembourg-based Q Cyber Technologies, and Novalpina Capital. [src-051]
  - Qualification: Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. The tracker calls the Luxembourg Q Cyber company NSO's parent, whereas register records show Q Cyber Technologies Ltd (Israel) as NSO's shareholder; no outcome is recorded.
- Attributed: According to the litigation tracker, complaints have been filed in France against NSO Group by the Gulf Center for Human Rights in July 2021 and by the International Federation for Human Rights, the Ligue des droits de l'homme and the human rights defender Salah Hammouri; the Paris prosecutor also opened an investigation into Pegasus on 20 July 2021 after complaints by the news site Mediapart and two of its reporters that Morocco had spied on them, and 17 more journalists later complained to the prosecutor. [src-051]
  - Qualification: Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. No outcome of the French complaints or of the investigation is recorded.
- Attributed: The tracker also records a civil suit against NSO Group filed in a Thai court in 2022 with the support of the Thai legal group iLaw, and letters before claim sent on 6 December 2022 to the Bahraini embassy in London and to NSO Group on behalf of the activist Yusuf al-Jamri. [src-051]
  - Qualification: Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. A letter before claim precedes a lawsuit and is not itself a proceeding.
- Attributed: In Israel, according to the tracker, Omar Abdulaziz sued NSO Group in 2018, alleging that it helped the Saudi royal court take over his smartphone and spy on his communications with the murdered journalist Jamal Khashoggi. [src-051]
  - Qualification: Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. The allegation is the plaintiff's; the final outcome of the suit is not recorded.
  - Response: NSO Group said its products were licensed for the sole use of governments and law enforcement agencies to fight terrorism and crime lawfully, only after full vetting and licensing by the Israeli government, and that it investigates suspected misuse and may suspend or terminate contracts.
  - Outcome: In 2020 an Israeli judge rejected NSO Group's motion to dismiss and its request to hold the trial in secret and ordered it to pay Abdulaziz's legal costs; NSO said it would appeal. The tracker dates the ruling to June 2020, but the press report it links to is dated 16 January 2020.
- Attributed: In July 2018 the Israeli Justice Ministry said a former NSO Group employee had been charged with stealing intellectual property and trying to sell it for $50 million over the Darknet in a manner that could harm state security. [src-051]
  - Qualification: Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. According to the ministry, the former employee's actions endangered NSO and could have led to its collapse.
- Documented: In Administrative Appeal 28312-05-19, 30 petitioners represented by attorney Eitay Mack, supported by Amnesty International, asked the Tel Aviv-Jaffa District Court sitting in administrative matters to order Israel's Defence Export Controls Agency to revoke the defence export licence of NSO Group Technologies Ltd, which they said had been used against Amnesty International activists. On 12 July 2020 Judge Rachel Barkai rejected the petition, finding no sufficient evidentiary basis that an attempted hacking of a human rights activist's phone had occurred or had been carried out by NSO, declining to state whether NSO held a licence, finding that DECA reviewed licences meticulously and monitored holders closely, and making no order for costs. [src-059] [src-021]
  - Qualification: The case was heard under a gag order, according to a 2021 NGO report.

## Who bought Pegasus? Documented, reported and denied customers

- Attributed: In their response and objection to the plaintiffs' proposed injunction order in the WhatsApp case, filed on 4 November 2025, NSO Group Technologies and Q Cyber Technologies stated that all of NSO's customers are sovereign governments, as confirmed by the auditing firm EY, and that contracts and Israeli Defence Ministry licences require Pegasus to be used only against terrorism and serious crime; they referred to major US allies, including Western European democracies, among their foreign sovereign customers without naming them. [src-081]
  - Qualification: The defendants' statements in court papers.
- Documented: An agreement dated 17 December 2015, filed as an exhibit to the WhatsApp complaint, provides for Infraloks Development Limited, a Ghanaian company (registration number CA-66,115) engaged in reselling and supplying cyber intelligence solutions developed by NSO Group Technologies Ltd, to supply a system to the National Communication Authority of the Republic of Ghana as end user; the system description refers to the System Provider's Pegasus system operating on Ghana mobile numbers, and an attached service level agreement is between NSO Group Technologies Ltd and Infralok Development Limited. [src-004]
  - Qualification: An exhibit filed by the plaintiffs; the retained copy is a scanned text with recognition errors.
- Attributed: According to answers NSO Group gave the European Parliament's inquiry committee in 2022, Pegasus was initially sold to 22 end users in 14 EU member states under Israeli marketing and export licences. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. The member states are not named by NSO.
  - Outcome: Contracts with end users in two member states were later terminated; the committee could not confirm which states these were and assumed the two were Poland and Hungary.
- Attributed: The Polish government, after initially denying it, confirmed the purchase of spyware in January 2022; former head of the Supreme Audit Office Krzysztof Kwiatkowski presented to the Senate two invoices confirming a purchase of spyware for the Central Anti-Corruption Bureau (CBA) for PLN 25 million from the Justice Ministry's Justice Fund, issued by Matic Sp. z o.o., which acted as intermediary. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.
- Attributed: The European Parliament report states that Hungary's Interior Ministry bought Pegasus for EUR 6 million in 2017 indirectly, through Communication Technologies Ltd, from NSO Group's company in Luxembourg, a purchase acknowledged in November 2021 by Lajos Kósa, chair of the parliamentary defence and law enforcement committee; Communication Technologies later sued the journalist Szabolcs Panyi after he investigated it. Hungary's data protection authority, which had access to the secret contract with NSO, said its inquiry found nothing inconsistent with NSO Group's terms of sale, though according to the report it verified only the authorisation procedure, not the substance of the use. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. The report does not name the Luxembourg company.
- Attributed: It was reported in September 2021 that Germany's Federal Criminal Police Office (BKA) had acquired Pegasus in late 2020; according to the European Parliament report NSO initially declined to modify the software to comply with German law but later agreed, so the BKA acquired a modified version, a purchase confirmed by then BKA vice-president Martina Link in a closed parliamentary session. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.
- Attributed: According to the European Parliament report, in October 2021 Luxembourg's Prime Minister Xavier Bettel confirmed that Luxembourg bought and used Pegasus for reasons of state security. [src-066] [src-015]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.
  - Response: A Luxembourg business publication's headline of 28 October 2021 states that Bettel appeared to confirm the purchase but later backtracked on his comments; the article's text was not retained.
- Attributed: Other governments' positions recorded in the European Parliament report differ: Austria's government stated in answers of 22 September 2021 that Austria had not been a client of NSO; France's foreign ministry denied holding talks with NSO Group, although media reported that a French purchase was suspended in 2021; Belgium's justice minister declined to confirm whether Belgian intelligence was a client after a former Israeli intelligence official said Belgian police used Pegasus; and the Dutch government refused to comment on media reports of June 2022 that its intelligence service had used Pegasus to help the police track down a serious-crime suspect. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. These are denials, reports and refusals to comment, not records of contracts.
- Attributed: The European Parliament report concluded that, given the secrecy surrounding it, it could not be determined with certainty whether the Spanish government concluded contracts with NSO Group or acquired and used Pegasus; Shalev Hulio, then NSO's chief executive, told a US magazine in April 2022 that Spain's use of Pegasus was legitimate given its respect for the rule of law and the requirement of Supreme Court authorisation. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Hulio's remark concerns use of the product, not a contract.
- Attributed: The report, citing press, states that Estonia negotiated with NSO Group in 2018 and made a down payment on a USD 30 million deal, and that in January 2020 NSO Group submitted to Greece an official proposal for a government-to-government agreement of EUR 50 million. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Press-based accounts; neither government's contract is in the retained documents.
  - Outcome: According to the report, Israel's Defence Ministry later blocked Estonia from using the spyware against Russian devices, and the Greek arrangement was eventually called off.
- Attributed: Citing a book and Israeli press, the European Parliament report states that in 2017 NSO officials presented Pegasus 3 to Saudi Arabian customers at the Four Seasons Hotel in Limassol, Cyprus, and that the Saudi customers bought it for USD 55 million; the report adds that a year later Saudi Arabia killed Jamal Khashoggi after surveilling people close to him with Pegasus, which NSO disputes. It also records a document from the Cypriot party AKEL alleging that NSO exported Pegasus through a Cypriot subsidiary to a company in the United Arab Emirates against an invoice of USD 7 million, which the report says cannot be confirmed. In a March 2025 US court filing, Treo NOAL GP, general partner of the fund that bought NSO in 2019, said that information it obtained after the 2021 Entity List designation showed NSO had been heavily dependent on collections from new sales to high-risk customers such as Saudi Arabia. [src-066] [src-106]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Unconfirmed allegations and a party's statement; no contract is in the retained documents.
  - Response: NSO disputes the report's statement that Saudi Arabia surveilled people close to Khashoggi with Pegasus.
- Attributed: According to US public radio as cited in the European Parliament report, Morocco had a licence for about 100,000 phone numbers, making it one of NSO's largest Pegasus clients. A 2026 investigation by an international journalism network, based on a former officer of Morocco's DGST intelligence service and a second former intelligence source, reported that the DGST procured and administered Pegasus through a private intermediary, which the reporters identified from the former officer's description as FSSYS Maroc in Rabat. [src-066] [src-083]
  - Qualification: Press and witness accounts; no contract is in the retained documents, and the reporters found no evidence that the intermediary itself carried out infections.
  - Response: Morocco called the Pegasus Project accusations erroneous and has long denied using Pegasus; Moroccan authorities, NSO Group and the chairman of FSSYS Maroc did not respond to the 2026 investigation's questions.
- Attributed: A 2026 investigation by an international journalism network reported that NSO Group sold Pegasus to Panama in 2012, with Shalev Hulio signing the contract with the Panamanian government. The investigation also reported that Panamanian migration records show Hulio entering Panama on 3 December 2013 on a diplomatic passport issued by Israel, with his profession given as "diplomat", a use of a diplomatic passport that a former senior Panamanian official confirmed; it presented this as raising questions about the firm's stated independence from the Israeli state. [src-079]
  - Qualification: Press account; the contract, the Panamanian judgment and the migration records were not retained.
  - Response: Hulio called the allegations concerning a diplomatic passport and his purported role as a representative of the State of Israel entirely false and categorically denied them; Israel's defence and foreign ministries did not respond.
  - Outcome: According to the investigation, in 2023 Panama's Supreme Court sentenced two former officials to 50 months in prison for breaches of confidentiality and of the right to privacy related to Pegasus.
- Attributed: The European Parliament report, citing an international human rights organisation, names 14 non-EU countries whose authorities are most likely responsible for many cases of technically proven Pegasus infection: El Salvador, Mexico, Thailand, Morocco, India, Rwanda, Saudi Arabia, Bahrain, Jordan, Kazakhstan, Togo, the United Arab Emirates, Israel and Azerbaijan. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. This attributes infections to states; it does not document contracts with NSO.
- Attributed: The report also cites a book alleging that a former NSO employee working for a company of Tal Dilian trained Cyprus's intelligence service in the use of Pegasus and that the Cypriot government bought equipment from Dilian's company; Cyprus's government told the committee that NSO Group holds no shares in Cypriot companies, that Pegasus did not appear to have been developed in or officially exported from Cyprus, and that board members of NSO had set up or bought six companies there. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Allegations from a book, set against the Cypriot government's answer.
  - Response: Cyprus's government: Pegasus did not appear to have been developed in or officially exported from Cyprus.
- Attributed: The European Parliament report states that Ability Ltd, founded by Anatoly Hurgin, cooperated with NSO Group on Pegasus and handled the network side of NSO's operations, and that in 2017 Ability was under investigation by the US Securities and Exchange Commission over alleged misstatements of its finances. [src-066]
  - Qualification: Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.
- Attributed: A British business newspaper reported in April 2022, according to three people with knowledge of the matter, that Mubadala Capital, a unit of an Abu Dhabi state fund chaired by Crown Prince Sheikh Mohammed bin Zayed al-Nahyan, was one of the largest investors in the €1 billion private equity fund that bought NSO in 2019, and that the Abu Dhabi government internally discussed buying NSO outright in autumn 2021. [src-107] [src-096]
  - Qualification: Press account from unnamed sources, as republished by other outlets; Mubadala's stake in the fund is not quantified.
  - Outcome: According to the same account, the Abu Dhabi discussions did not progress beyond preliminary conversations.

## Founders, executives, directors and advisers of Q Cyber and NSO

- Attributed: According to the 2021 NGO report, the founders of NSO Group Technologies, whose first initials make up the name NSO, were the businessmen Niv Carmi, Shalev Hulio and Omri Lavie, and an initial investor was the venture capitalist Eddy Shalev; the European Parliament report likewise gives 2010 as the year the group was founded by Hulio, Lavie and Niv Karmi. [src-021] [src-092] [src-066]
  - Qualification: The spelling of Karmi/Carmi varies between sources for the same person.
  - Response: NSO Group told the report's authors that Niv Carmi was no longer affiliated with the group.
  - Outcome: Israeli business press reported in 2025 that Carmi had left NSO after less than a year.
- Attributed: Shalev Hulio was NSO Group's co-founder and chief executive: a profile on a company-data site lists him as co-founder and vice-president of marketing of NSO Group from December 2009 and chief executive from March 2016, and as a partner of the investment firm Founders Group. [src-076] [src-020] [src-066]
  - Qualification: Aggregator profile and report; Hulio appears in Luxembourg and UK records as "Shalev Holy".
  - Outcome: According to the European Parliament report he stepped down as chief executive in August 2022 and was replaced by Yaron Shohat, after which NSO, according to press cited in the report, changed policy to focus only on NATO members.
- Attributed: After leaving NSO, Shalev Hulio co-founded the cyber-defence and artificial-intelligence company Dream (Dream Security) with former Austrian chancellor Sebastian Kurz and Gil Dolev, the brother of NSO Group president Shiri Dolev; the European Parliament report dates its launch to October 2022 and records that its early investors included Adi Shalev, also an early investor in NSO. Israeli press reported in June 2026 that Dream had raised $260 million at a valuation of $3 billion. [src-066] [src-111] [src-044]
  - Qualification: Dates differ: the European Parliament report gives October 2022, Israeli press gives 2023 as the year of founding.
- Attributed: According to the European Parliament report, after public pressure over NSO's hiring of the private intelligence firm Black Cube against its opponents, former NSO chief executive Shalev Hulio admitted to hiring Black Cube in at least one situation in Cyprus. [src-066]
  - Qualification: Account in the European Parliament inquiry report; the admission itself is not retained.
- Attributed: Omri Lavie also co-founded the Tel Aviv cyber-risk company Orchestra Group (founded 2009, according to a company-data profile); in 2017 Lavie and his investment partner Issac Zack said Orchestra was being financed by their investment firm Founders Group, whose chief executive was Shalev Hulio. [src-112] [src-119]
  - Qualification: Company-data profile and a 2017 press interview.
- Attributed: Niv Karmi later founded Polus Tech in Zug, Switzerland, in 2016, with investment from Elta Systems of Israel Aerospace Industries, according to Israeli business press; Swiss commercial-register data list him as a board member of POLUS Tech. (Switzerland) Ltd and as president of the board of Therian Labs Technologies AG, a Zug company whose purpose includes selling software solutions in Asia, in particular Indonesia. A Swiss arms-export monitoring site reported that Therian Labs received Swiss export permits for Indonesia worth CHF 4.84 million in 2022 in the dual-use category 5A001.f covering mobile interception and jamming equipment. [src-092] [src-041] [src-065] [src-110] [src-123]
  - Qualification: These are Karmi's own companies, not NSO or Q Cyber companies; the export permits were reported by a monitoring site and the permit records themselves were not retained.
- Attributed: Eran Gorev is a partner and the president of Israel at Francisco Partners, which he joined in 2014, according to the firm's website; a company-data profile lists him as chairman of NSO Group from 2014 to 2019, and Luxembourg register publications, as summarised by an aggregator, list him as a manager of OSY Technologies between publications of 16 December 2014 and 12 April 2019 and of Q Cyber Technologies S.à r.l. from its registration in January 2016 until a publication of August 2019. [src-019] [src-094] [src-005]
  - Qualification: Website, aggregator profile and register summaries.
- Attributed: NSO Group announced in April 2020 that it had appointed Asher Levy, chief executive of Orbotech from 2013 to 2019, as executive chairman, an appointment approved by the board earlier that year and effective on 1 April 2020; a market-data profile lists him as former chairman of N.S.O. Group Technologies Ltd. [src-090] [src-070] [src-118]
  - Qualification: Company announcement, aggregator profile and press account.
  - Outcome: He left the chairmanship at the start of January 2022, saying he had represented Novalpina and was making way for BRG's appointee, and denied that his departure had anything to do with NSO's legal and financial troubles.
- Attributed: Yaron Shohat, previously NSO Group's chief operating officer according to a company-data profile, succeeded Shalev Hulio as chief executive in August 2022 and was also reported to be chief executive of Q Cyber Technologies; he testified as NSO's chief executive in August 2024 and, according to press in January 2026, stepped down after the 2025 change of ownership. [src-071]
  - Qualification: Aggregator profile and press; no register record of his offices was retained.
- Attributed: David M. Friedman was US ambassador to Israel from March 2017 to January 2021; before joining the State Department he practised law at Kasowitz, Benson, Torres & Friedman LLP, which he co-founded in 1994. A sanctions and PEP data service lists him as a politically exposed person on that basis and as named on the Iranian foreign ministry's own sanctions list. [src-016] [src-121]
  - Qualification: The Iranian listing is a measure by Iran against US individuals, not a Western sanction.
- Attributed: Robert Bruce Simonds Jr. is a film producer and founder and chairman of STX Entertainment, according to an online encyclopedia. Luxembourg press reported that in January 2026 he sold his production company, Crown Productions, which it described as the film-financing subsidiary of the insurance platform A-CAP. [src-023] [src-015]
  - Qualification: Encyclopedia and press accounts.
- Documented: Anthony Levy has been a manager of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l. since 15 March 2023, having earlier been a class B manager of NorthPole Newco from 22 December 2021 to 16 January 2023, and has been Q Cyber Technologies S.à r.l.'s delegate for day-to-day management since 5 June 2023, with a professional address in Luxembourg. [src-061] [src-043] [src-038]
- Attributed: Register summaries record Yuval Somekh as a manager of Q Cyber Technologies S.à r.l. from its registration in 2016 and of NorthPole Newco; according to the 2021 NGO report he was type B manager of Emerald LIE and Diamond LIE, which NSO Group said were created to grant stock options, with Gaëtan Dumont as type A manager. [src-021] [src-010] [src-006] [src-005]
  - Qualification: Register summaries and NSO Group's description.
  - Response: NSO Group told the 2021 NGO report that Hulio, Lavie, Somekh and Asher Levy were directors in the group and that Dumont was a professional director in five of the eight Luxembourg group companies, holding no other position in the group.
  - Outcome: Register publications of 4 and 26 November 2021, as summarised by an aggregator, record that Somekh was no longer a manager of OSY Technologies and of NorthPole Newco and Q Cyber Technologies S.à r.l. respectively.
- Attributed: A Luxembourg register publication of 20 August 2019, as summarised by an aggregator, lists Charline de Maigret as a manager of Q Cyber Technologies S.à r.l. [src-010]
  - Qualification: Aggregator summary of register publications.
- Attributed: NSO Group told the 2021 NGO report's authors that former employee Kevin Wilson was then a shareholder in Triangle Holdings, that former consultant Alexei Voronovitsky no longer held shares in any group company, that OSY Holdings Ltd. and Global Seven Group LP held no shares or other interest in Triangle Holdings, and that the group had no companies in the Cayman Islands or the British Virgin Islands. [src-021]
  - Qualification: NSO Group's statement in 2021.
- Attributed: Under Francisco Partners' ownership, according to the firm's statement to the 2021 NGO report, NSO's business ethics committee reviewed all potential sales and blocked tens of millions of dollars of sales that would otherwise have been legally permitted; Novalpina described it as a committee of the NSO board with three NSO executives and four external members, which media reports said included Daniel Reisner of the Israeli law firm Herzog Fox & Neeman. After the 2019 buyout it was replaced by a governance, risk and compliance committee which, according to NSO Group, is a board-level committee appointed by the board of OSY Technologies that oversees investigations into credible allegations of misuse. [src-021]
  - Qualification: Statements of Francisco Partners, Novalpina and NSO Group.
- Attributed: According to the European Parliament report, citing press, Jeremy Bash, a former chief of staff at the CIA (2009–2011) and the US Department of Defense (2011–2013), was hired through his firm Beacon Global Strategies to advise NSO Group through Francisco Partners and was reportedly one of eight members of NSO's business ethics committee with a vote on proposed sales. He served on the President's Intelligence Advisory Board from 2022 to 2025, and a sanctions and PEP data service lists him as a politically exposed person, with no sanctions or crime topics. [src-066] [src-109] [src-122]
  - Qualification: Press accounts relayed by the report and an encyclopedia entry.
  - Outcome: According to the same press accounts, Beacon Global Strategies ended its work with NSO after the group pursued sales to Saudi Arabia.
- Attributed: US press reported in 2017 that, according to his financial disclosure forms, Michael Flynn received $40,280 in 2016 as an advisory board member of OSY Technologies; a Francisco Partners representative told another publication that Flynn was paid a little more than $40,000 by OSY and less than $100,000 by Francisco. [src-104] [src-119]
  - Qualification: Press accounts of disclosure forms and a company representative's statement.
  - Response: Francisco Partners' general counsel said Flynn had served in a relatively limited advisory role and that the firm routinely engages consultants to understand the industries it invests in; Flynn's lawyer did not respond to requests for comment.
- Documented: Francisco Partners Management, L.P. is a US investment adviser registered with the SEC (CRD 160272) that advises private funds; its Form ADV states that it managed about $47.05 billion of fund assets at 31 December 2025. [src-022]
  - Qualification: Read from a company-data site's copy of the Form ADV.

## Westbridge, Convexum and other companies around Q Cyber and NSO

- Attributed: According to the 2021 NGO report, Westbridge Technologies Inc. was incorporated in Delaware on 22 July 2014 with Omri Lavie named as president or vice-president in corporate documents, had branches registered in Maryland in 2016 (dissolved in June 2019) and Virginia in 2019, and was described in the professional profile of its former president Terry DiVittorio as the US affiliate of Q Cyber Technologies. It was then registered as an active US federal contractor (CAGE code 7FQ39) whose registration gave its immediate owner as Francisco Partners GP III Management, LLC; NSO Group told the authors that there is no relationship between Westbridge and Francisco Partners, that Westbridge's ownership passed in the 2019 Novalpina transaction and that the registration was incorrect. [src-021]
  - Qualification: Records as described in the report.
  - Response: NSO Group: the federal contractor registration naming Francisco Partners as owner is incorrect.
- Attributed: The WhatsApp complaint described Westbridge Technologies, Inc. as NSO Group's US marketing and sales arm; a 2020 report based on records obtained through public-records requests said a Westbridge brochure called the company "the North American branch of NSO Group", stressed that it was based in Bethesda, Maryland and then majority owned by an American private equity firm, and marketed a product called Phantom, which a former NSO employee described as the US brand of Pegasus; a 2022 report said Westbridge pitched the spyware to US law enforcement. [src-004] [src-103] [src-098]
  - Qualification: Allegation in the complaint and press accounts.
  - Response: An NSO spokesperson told the 2020 publication that NSO Group products sold to foreign sovereigns cannot be used to conduct cyber-surveillance within the United States and that no customer has ever been granted technology enabling the targeting of phones with US numbers.
  - Outcome: According to the 2020 report, the US Drug Enforcement Administration, to which Westbridge had demonstrated the technology, and the San Diego police did not buy it because of its cost.
- Attributed: Francisco Partners said that it never held a direct interest in Westbridge and that its indirect interest through OSY Holdings and Triangle ended on 18 March 2019; OSY Technologies' accounts record OSY's equity interests in Westbridge Technologies, Inc., pledged to the lenders' collateral agent since April 2019, and NSO Group and Q Cyber told a US court in 2023 that Westbridge is an affiliate owned by the same ultimate parent as NSO Group rather than NSO's subsidiary. [src-062] [src-021] [src-058]
  - Qualification: Positions of Francisco Partners and the defendants, and OSY's accounts.
- Attributed: According to the 2021 NGO report, NSO Group Technologies Ltd. acquired the Israeli counter-drone company Convexum Ltd. in February 2020 for $60 million, and one of Convexum's previous shareholders was F2 Capital Ltd., chaired by NSO investor Eddy Shalev; NSO Group said Convexum develops and exports the Eclipse anti-drone system. [src-021]
  - Qualification: The report's account; Israeli press later reported that Convexum was controlled in practice by Triangle rather than NSO and was separated from NSO after a court dispute.
- Documented: UK Companies House records PFOS Technologies Limited, company number 08521034, incorporated in England on 9 May 2013 and dissolved on 30 November 2021; the 2021 NGO report states that NSO Group Technologies Ltd. was its sole shareholder and that its principal activity was marketing services for its parent. [src-063]
  - Qualification: The shareholding is the report's statement from UK filings.
- Attributed: According to the European Parliament report, the NSO group has had a corporate presence in Israel, the United Kingdom, Luxembourg, the Cayman Islands, Cyprus, the United States, the Netherlands, Bulgaria and the British Virgin Islands; citing the 2021 NGO report, it states that between November 2014 and December 2016 the group operated through two Dutch companies, Shapes 1 BV and Shapes 2 BV, financial holding companies later liquidated. [src-066]
  - Qualification: Account of the inquiry report relying on NGO research.

## Sources

- [src-004] Court record source · src-004
- [src-084] Company statement source · src-084
- [src-021] Research source · src-021
- [src-078] MOD tightens control of cyber exports, Israel Ministry of Defense, 2021-12-07 <https://www.gov.il/en/pages/mod-tightens-control-of-cyber-exports-6-december-2021>
- [src-082] Media source · src-082
- [src-064] Exhibit A and agreement, FARA registration No. 6170 (Mercury Public Affairs, LLC), US Department of Justice, FARA Registration Unit, 2019-12-25 <https://efile.fara.gov/docs/6170-Exhibit-AB-20191225-73.pdf>
- [src-099] Media source · src-099
- [src-101] Media source · src-101
- [src-025] Addition of Certain Entities to the Entity List (2021-24123), US Department of Commerce, Bureau of Industry and Security (Federal Register), 2021-11-04 <https://www.federalregister.gov/documents/2021/11/04/2021-24123/addition-of-certain-entities-to-the-entity-list>
- [src-086] Electronic Code of Federal Regulations: search for "NSO Group" (version history), Office of the Federal Register (eCFR) <https://www.ecfr.gov/api/search/v1/results?query=%22NSO%20Group%22&per_page=20>
- [src-087] Electronic Code of Federal Regulations: search for "NSO Group" as of 20 October 2026, Office of the Federal Register (eCFR), 2026-10-20 <https://www.ecfr.gov/api/search/v1/results?query=%22NSO%20Group%22&date=2026-10-20&per_page=5>
- [src-008] Sanctions list source · src-008
- [src-093] Media source · src-093
- [src-015] Media source · src-015
- [src-077] Letter of Representative Summer L. Lee to the Secretary of Commerce regarding NSO Group, US House of Representatives (office of Rep. Summer L. Lee), 2026-05-06 <https://summerlee.house.gov/sites/evo-subsites/summerlee.house.gov/files/evo-media-document/2026-05-06.lee-letter-to-commerce-re-nso-group.pdf>
- [src-080] Media source · src-080
- [src-066] Report of the investigation of alleged contraventions and maladministration in the application of Union law in relation to the use of Pegasus and equivalent surveillance spyware (A9-0189/2023), European Parliament, 2023-05-22 <https://data.europarl.europa.eu/distribution/reds_iPlRp/A-9-2023-0189/A-9-2023-0189_en.pdf>
- [src-028] Written question No. 3833: Activities of NSO Group in Luxembourg and possible links with Togo, Chamber of Deputies of Luxembourg, 2026-04-28 <https://www.chd.lu/fr/question/30549>
- [src-088] Media source · src-088
- [src-089] Research source · src-089
- [src-100] Regulatory record source · src-100
- [src-108] Research source · src-108
- [src-002] Corporate registry source · src-002
- [src-003] Corporate registry source · src-003
- [src-014] Corporate registry source · src-014
- [src-113] Corporate registry source · src-113
- [src-069] Company statement source · src-069
- [src-011] Media source · src-011
- [src-048] Media source · src-048
- [src-039] Corporate registry source · src-039
- [src-040] Corporate registry source · src-040
- [src-053] Court record source · src-053
- [src-058] Court record source · src-058
- [src-026] WhatsApp Inc. v. NSO Group Technologies Limited, No. 20-16408, opinion, US Court of Appeals for the Ninth Circuit, 2021-11-08 <https://cdn.ca9.uscourts.gov/datastore/opinions/2021/11/08/20-16408.pdf>
- [src-067] Court record source · src-067
- [src-001] Court record source · src-001
- [src-068] Corporate registry source · src-068
- [src-062] Annual accounts 2024: Osy Technologies S.à r.l. (filing L250268646), Luxembourg Business Registers, 2025-08-05 <https://gd.lu/rcsl/b2VbVh>
- [src-005] Corporate registry source · src-005
- [src-104] Media source · src-104
- [src-119] Media source · src-119
- [src-116] Other source · src-116
- [src-035] RESA publication RESA_2025_242.307: NorthPole Newco S.à r.l., Luxembourg Business Registers, 2025-11-07 <https://gd.lu/resa/5H0k95>
- [src-038] RESA publication RESA_2025_235.223: Osy Technologies S.à r.l., Luxembourg Business Registers, 2025-10-30 <https://gd.lu/resa/fDdxHV>
- [src-043] RESA publication RESA_2025_233.613: Q Cyber Technologies (B203124), Luxembourg Business Registers, 2025-10-28 <https://gd.lu/resa/1gSDVs>
- [src-009] Company statement source · src-009
- [src-115] Media source · src-115
- [src-120] Media source · src-120
- [src-106] Court record source · src-106
- [src-018] Corporate registry source · src-018
- [src-006] Corporate registry source · src-006
- [src-102] NOAL SCSp and others v. Novalpina Capital LLP and others [2025] EWHC 1392 (Ch), High Court of England and Wales (The National Archives), 2025-06-06 <https://caselaw.nationalarchives.gov.uk/ewhc/ch/2025/1392>
- [src-075] Corporate registry source · src-075
- [src-061] Annual accounts 2024: NorthPole Newco S.à r.l. (filing L250250760), Luxembourg Business Registers, 2025-07-29 <https://gd.lu/rcsl/ffVdlj>
- [src-024] Media source · src-024
- [src-045] Media source · src-045
- [src-097] Company statement source · src-097
- [src-114] Media source · src-114
- [src-117] Media source · src-117
- [src-073] RESA publication RESA_2023_004.529: Triangle Holdings, Luxembourg Business Registers, 2023-01-04 <https://gd.lu/resa/bLSz0q>
- [src-060] Media source · src-060
- [src-118] Media source · src-118
- [src-105] Media source · src-105
- [src-124] Officers: Triangle Holdings S.A. (FC040779), Companies House, 2026-10-22 <https://find-and-update.company-information.service.gov.uk/company/FC040779/officers>
- [src-007] Corporate registry source · src-007
- [src-091] Media source · src-091
- [src-013] Media source · src-013
- [src-012] Media source · src-012
- [src-027] Media source · src-027
- [src-050] Media source · src-050
- [src-034] RESA publication RESA_2025_277.1590: NorthPole Newco S.à r.l., Luxembourg Business Registers, 2025-12-22 <https://gd.lu/resa/4jPpV6>
- [src-033] RESA publication RESA_2026_048.374: NorthPole Newco S.à r.l., Luxembourg Business Registers, 2026-02-26 <https://gd.lu/resa/4NGfvf>
- [src-016] Witness biography: Ambassador David M. Friedman, US House of Representatives, 2026-07-22 <https://www.congress.gov/119/meeting/house/119487/witnesses/HHRG-119-FA13-Bio-FriedmanD-20260722.pdf>
- [src-037] RESA publication RESA_2025_282.256: Osy Technologies S.à r.l., Luxembourg Business Registers, 2025-12-30 <https://gd.lu/resa/cBcvjz>
- [src-010] Corporate registry source · src-010
- [src-029] Media source · src-029
- [src-042] Corporate registry source · src-042
- [src-036] Corporate registry source · src-036
- [src-032] Corporate registry source · src-032
- [src-074] RESA publication RESA_2023_142.1382: Triangle Holdings, Luxembourg Business Registers, 2023-07-07 <https://gd.lu/resa/4nwDhH>
- [src-072] Corporate registry source · src-072
- [src-017] Corporate registry source · src-017
- [src-095] Corporate registry source · src-095
- [src-030] Court record source · src-030
- [src-057] Court record source · src-057
- [src-056] Court record source · src-056
- [src-052] Docket No. 21-1338: NSO Group Technologies Limited, et al. v. WhatsApp Inc., et al., Supreme Court of the United States, 2023-01-09 <https://www.supremecourt.gov/docket/docketfiles/html/public/21-1338.html>
- [src-031] Court record source · src-031
- [src-081] Court record source · src-081
- [src-085] Court record source · src-085
- [src-046] Court record source · src-046
- [src-047] Court record source · src-047
- [src-049] Court record source · src-049
- [src-054] Court record source · src-054
- [src-055] Court record source · src-055
- [src-051] Research source · src-051
- [src-059] Court record source · src-059
- [src-083] Media source · src-083
- [src-079] Media source · src-079
- [src-107] Media source · src-107
- [src-096] Media source · src-096
- [src-092] Media source · src-092
- [src-076] Other source · src-076
- [src-020] Other source · src-020
- [src-111] Media source · src-111
- [src-044] Company statement source · src-044
- [src-112] Other source · src-112
- [src-041] Corporate registry source · src-041
- [src-065] Corporate registry source · src-065
- [src-110] Corporate registry source · src-110
- [src-123] Media source · src-123
- [src-019] Company statement source · src-019
- [src-094] Other source · src-094
- [src-090] Company statement source · src-090
- [src-070] Other source · src-070
- [src-071] Other source · src-071
- [src-121] Sanctions list source · src-121
- [src-023] Other source · src-023
- [src-109] Other source · src-109
- [src-122] Sanctions list source · src-122
- [src-022] Regulatory record source · src-022
- [src-103] Media source · src-103
- [src-098] Media source · src-098
- [src-063] Company record: PFOS Technologies Limited (08521034), Companies House <https://find-and-update.company-information.service.gov.uk/company/08521034>