How Francisco Partners bought NSO through Q Cyber (2014–2019)

analysisOn 5 February 2014 OSY Technologies S.à r.l., a Luxembourg company, agreed with NSO Group Technologies and its shareholders to acquire all rights in NSO in two stages: $70 million in cash for 70% of the rights and, for the remaining 30%, an exchange of NSO shares for shares in Triangle Holdings, which made NSO's original shareholders partners in Francisco Partners' cyber business. On 17 March 2014 the shares of Q Cyber, then still called L.E.G.D. Company, passed to OSY; on 19 March 70% of NSO's shares were transferred from OSY to Q Cyber under a trust agreement, and on 30 November the remaining 30% were exchanged for Triangle shares. Q Cyber's financial statements, as quoted by the court, describe NSO as the subsidiary it acquired in 2014 from its parent OSY. ¹

qualification

These steps are findings recited in the Israeli Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal; Q Cyber's financial statements were quoted by the court and were not themselves retained.

analysisThe price is recorded differently. The judgment gives $70 million in cash for 70% of the rights; the 2021 NGO report states that Francisco Partners III acquired a 70% stake for $115 million in a deal announced in March 2014 and reportedly approved by Israel's Ministry of Defense; and a 2017 news report puts the purchase at $120 million. The figures may measure different components of the same transaction, and none of the retained records reconciles them. ^{2 3}

analysisA 2023 European Parliament inquiry report, relying on the NGO report, gives further figures: just under $130 million for Circles, 90% of NSO for Francisco Partners, and a merger of Circles and NSO under L.E.G.D. Company Ltd., known as Q Cyber Technologies Ltd. since 29 March 2016. Those details differ from the primary records: the Israeli name-change certificate is dated 29 May 2016, and the other accounts give Francisco Partners 70% of NSO, not 90%. ⁴

analysisThe tax-appeal judgment of 28 July 2026 describes OSY as a Luxembourg-resident company that Francisco Partners held not directly but through a chain of companies headed by Triangle Holdings S.A. Francisco Partners told the authors of the 2021 NGO report that from March 2014 to 18 March 2019 its fund Francisco Partners III held an indirect controlling interest in NSO through OSY Holdings Ltd., a wholly owned Cayman Islands vehicle that controlled Triangle, never exported anything and did nothing but hold that interest; by 2021, it said, OSY Holdings had no remaining assets or liabilities and was being dissolved under Cayman Islands law. ^{1 2 3}

qualification

Francisco Partners called OSY Holdings an exempted limited partnership, whereas Triangle's minutes of 1 December 2014 describe OSY Holdings Limited as an exempted company registered with the Cayman Islands Companies Register under number MC-284745.

analysisAccording to Luxembourg and Cayman records cited in the 2021 NGO report, OSY Technologies was incorporated on 3 February 2014 with OSY Holdings Ltd., registered in the Cayman Islands on 30 January 2014, as its sole shareholder, and from March 2014 OSY was the sole shareholder and active director of L.E.G.D. Company; OSY's own 2024 accounts confirm its incorporation date. The same report states that Triangle Holdings SA and Square 2 S.à r.l. were each incorporated in Luxembourg on 21 November 2014, and that OSY Holdings became Triangle's sole shareholder, with Eran Gorev, a Francisco Partners director and newly appointed NSO chair, as its sole director; Triangle became Square 2's sole shareholder, and Square 2 took full ownership of OSY. An aggregator summary of the Luxembourg register records Square 2 as OSY's shareholder from 28 November 2014. ^{2 4 5}

analysisThe Israeli annual reports updated to 7 January 2019 show the chain at Q Cyber's level. Q Cyber's own report, signed on 16 June 2019, lists OSY Technologies (Luxembourg register number B184226) as its sole shareholder with all 100,000 ordinary shares and as its director since 17 March 2014, with Yifa Idisis as financial director. NSO's report names Q Cyber as NSO's director from 19 March 2014, a financial director named Idisis, and two shareholders: Q Cyber, with 118,263 ordinary, 8,936 ordinary A and 295,170 preferred A shares, and NSO itself, with 67,453 ordinary shares. ⁶

analysisThe 2021 NGO report observed that these 67,453 treasury shares were 36% of NSO's allotted ordinary shares and that it was unclear who exercised their ownership. NSO Group replied that Israeli law allows a company to hold its own shares, for example after a buyback, and that the full ownership rights in NSO Group Technologies are therefore held by Q Cyber. The buyback itself is not documented in the retained records. ²

analysisMinutes of Triangle's extraordinary general meeting of 1 December 2014, published in Luxembourg's official gazette, start from OSY Holdings Limited as sole shareholder and raise the capital from USD 48,038.80 to USD 74,548.10 with new class A and class D shares. Omri Lavie and Shalev Hulio, recorded as Shalev Holy, each subscribed 67,263 class D shares (9% of the capital) for 50 NSO shares; Eddy Shalev 13,444 class D shares (1.8%) for 10 NSO shares; the Israeli trust company ESOP Management and Trust Services 20,767 class A shares (2.8%) for 20,767 NSO shares; and, for cash, Global Seven Group LP, a British Virgin Islands limited partnership, 89,458 class D shares (12%) and Eran Gorev 6,336 class D shares (0.8%). The minutes do not name Global Seven Group's general partner or beneficial owners. ¹

analysisThe 2021 NGO report summarises the result as about 35.5% of Triangle for the new shareholders, including Alexei Voronovitsky with 0.1%, and the remaining 64.5% for OSY Holdings, that is Francisco Partners. NSO Group told the authors that the trust company held shares and options for employees under the company's employee stock ownership plan, an entity the tax rules required. According to the report, Triangle's board resolved on 18 February 2019 to buy back the trust's shares, which ended its shareholding. ²

analysisOn 1 December 2014 Triangle appointed as directors Alessandro Celli, Jonathan Murphy, Andrew Kowal and Matthew Spetzler, all with professional addresses in London or San Francisco, the latter Francisco Partners' registered office, together with Frédéric Gardeur, Omri Lavie, Shalev Hulio and Boaz Goldman of the Circles group, with Andreas Koutsos as observer. According to Triangle's minutes as summarised in the NGO report, on 1 April 2019 the company acknowledged the resignations of Goldman, Eran Gorev, Kowal, Murphy and Spetzler as class A directors. ^{1 2}

analysisAlongside NSO, Francisco Partners acquired through OSY on 1 December 2014 the Circles group of companies, also active in the cyber field, according to the judgment. The 2021 NGO report adds that Circles was founded in 2010 by Tal Dilian, Boaz Goldman and Eric Banoun, is known for technology exploiting vulnerabilities in the SS7 telephone signalling network for surveillance, and cost Francisco Partners $130 million. Citing OSY's 2014 accounts, the report states that OSY also acquired IOTA Holdings Ltd., registered in Cyprus on 4 November 2014 and parent of CS-Circles Solutions Ltd., Global Hubcom Ltd. and MS Magnet Solutions Ltd. The report adds that CS-Circles Solutions owns Circles Bulgaria EOOD (incorporated in July 2017) and MS Magnet Solutions owns Magnet Bulgaria EOOD (incorporated in April 2014). NSO Group told the authors that the Circles-linked company CT-Circles Technologies Ltd. is not part of the NSO Group. ^{1 2}

analysisA US business magazine reported in December 2017 that Francisco Partners had months earlier failed to sell part of NSO to the New York-based Blackstone Group at a reported valuation of $1 billion, and that the deal collapsed amid reports that summer about the use of NSO's spyware in Mexico. The sale did not take place; no other retained record describes the negotiations. ¹