SpyLedger dossier · Mercenary spyware

NSO Group

NSO Group Technologies Ltd. is a surveillance-technology firm founded in 2010 (founders Niv Karmi, Shalev Hulio, Omri Lavie). It operates under the Q Cyber Technologies group, which is known as OSY Technologies in Luxembourg; a North American subsidiary previously operated as Westbridge. It is privately held (not publicly traded).

Products

Pegasus
Phantom
Circles

Government designation status

1 active designation from the surveyed authorities. Each is a public government record with a different legal effect — read the type label and scope on each.

US BISExport controlEntity List · 2021-11-04

A license is required to export US-origin items/technology to the entity, typically reviewed under a presumption of denial (e.g. BIS Entity List). It is not an asset freeze.

Added by the Bureau of Industry and Security to the Entity List (Supplement No. 4 to 15 CFR Part 744), effective November 4, 2021, based on a determination that NSO Group developed and supplied spyware used by foreign governments to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers. Effect: a license is required for the export, reexport, or in-country transfer of all items subject to the EAR to NSO Group, no license exceptions are available, and BIS applies a license-review policy of presumption of denial. This is an export-control restriction on US-origin items/technology going TO NSO; it is NOT an asset-blocking sanction (no OFAC SDN designation, no property blocking, no general prohibition on dealings with the company).

Federal Register: Addition of Certain Entities to the Entity List (86 FR 60759; Doc. 2021-24123)

No US OFAC SDN/sanctions designation, no US Treasury NS-CMIC investment listing (that list is by statute limited to Chinese military-industrial-complex companies and cannot apply to this firm), no EU consolidated-sanctions designation, and no US FCC Covered List entry on public record as of the research date (2026-06). NSO Group's only verified government designation among the surveyed authorities is its November 4, 2021 addition to the US BIS Entity List, which is an export-control measure rather than an asset-blocking sanction. Human-rights organizations have publicly called for EU sanctions, but no EU designation has been imposed. The FCC Covered List is scoped to telecommunications and video-surveillance equipment and services and does not include NSO Group.

This dossier restates public government-designation records; it is not an allegation of wrongdoing by AI Analytics, and it publishes no customer-deployment claims or targeting data. A designation describes a specific legal action by a named authority — read its scope; an export control, an equipment-authorization restriction, and an asset-blocking sanction are not the same thing. To dispute or correct an entry, contact us (see the methodology). Status current as of the 2026-06-23 build — confirm against the linked primary source. Back to all vendors.