--- alias: - NSO Group Technologies category: Private Organization created: 2026-06-18 location: Herzliya, Israel summary: NSO Group is an Israeli cyber-intelligence company founded in 2010 by Unit 8200 alumni Omri Lavie, Shalev Hulio, and Niv Karmi, developer of the Pegasus spyware capable of zero-click mobile-phone compromise, whose government clients used the product to surveil over 50,000 targets including Jamal Khashoggi's family, 180 journalists, Catalan independence leaders, and Mexican activists before the July 2021 Pegasus Project exposure. tags: - Organization - NSOGroup - Pegasus - Spyware - Unit8200 - Israel - Khashoggi - MBS - PrivateIntelligence - Surveillance updated: 2026-06-18 --- NSO Group is an Israeli cyber-intelligence company founded in 2010 in Herzliya, [Israel](/places/israel/), by Omri Lavie, Shalev Hulio, and Niv Karmi (the company name derives from their first initials: N-S-O). The founders are alumni of [Unit 8200](/organizations/unit-8200/), Israel's elite military intelligence signals-and-cyber unit that serves as the incubator of the Israeli private surveillance-technology sector. NSO developed Pegasus, a spyware capable of zero-click mobile-phone compromise that extracts messages, emails, photos, location data, and activates cameras and microphones without the target's knowledge. The Pegasus Project investigation (July 2021), coordinated by Forbidden Stories and Amnesty International across 80 journalists from 17 media outlets, documented a leaked list of over 50,000 phone numbers selected as potential surveillance targets by NSO's government clients.[^1][^2][^3] ### The Unit 8200 Pipeline Unit 8200 is the IDF signals-intelligence and cyber-warfare unit that functions as the documented talent pipeline for the Israeli private cybersecurity and surveillance industry. NSO Group's founders are alumni of the unit, as are the founders of a documented network of Israeli surveillance-technology firms that collectively constitute the "tip of the iceberg" of what the OCCRP and the Boston Review describe as a largely unregulated transnational Israeli surveillance industry. Former IDF intelligence officers and former NSO employees have gone on to found additional firms developing zero-click weapons and offensive cyber tools, extending the Unit 8200 pipeline into the broader commercial-surveillance sector.[^4][^5] The Unit 8200 pipeline connects the NSO Group to the broader Israeli surveillance-technology export sector documented on the [Carbyne](/organizations/carbyne/) page (the Epstein-Barak-Israeli surveillance-tech investment chain) and to the [Palantir](/organizations/palantir-technologies/)-Israel strategic partnership. The sector operates on the model documented by the Jacobin reporting: Israeli surveillance technology developed through the occupation of Palestinian territories is exported commercially, with the occupied territories functioning as what critics describe as a testing laboratory.[^5][^6] ### Pegasus and the Government-Client Model NSO licensed Pegasus exclusively to government clients, framing the product as a counterterrorism tool. The documented deployment went far beyond counterterrorism. The Pegasus Project investigation documented that NSO's clients used Pegasus against heads of state, government officials, journalists, activists, political opponents, and the family members of targeted individuals. The leaked list of 50,000+ phone numbers includes targets across multiple countries.[^1][^3] The documented deployment patterns include: [Mexico](/places/mexico/) (one of NSO's largest clients, where multiple administrations used Pegasus against journalists including Cecilio Pineda Brito, activists, lawyers, and even a child, per the Citizen Lab investigation); Catalonia (the "CatalanGate" finding by Citizen Lab in 2022 documenting dozens of Catalan independence politicians and activists targeted by the Spanish state); [El Salvador](/places/el-salvador/) (surveillance continuing through 2022 despite NSO's reform pledges); and the [Saudi](/places/saudi-arabia/) targeting of Khashoggi's associates.[^1][^7][^8][^9] ### The Khashoggi Surveillance Pegasus was deployed against the associates of Jamal Khashoggi before the October 2018 murder inside the Saudi consulate in Istanbul. The Guardian reported in July 2021, based on the Pegasus Project leak, that Pegasus was found on the phone of Khashoggi's wife Hanan Elatr months before the killing. An Emirati government agency separately placed NSO spyware on the phone of a Khashoggi associate, Al Jazeera reported. Khashoggi's friend Omar Abdul Aziz sued NSO Group, claiming the spyware enabled the murder by mapping Khashoggi's network and communications. A federal judge dismissed the widow's lawsuit against NSO in October 2023.[^10] The Khashoggi surveillance ran through the same MBS-WhatsApp channel that [Jared Kushner](/people/jared-kushner/) used to communicate with the Saudi crown prince, and through the broader Saudi-Emirati intelligence network that operated Pegasus against the targets. The NSO Group sits at the intersection of the documented surveillance infrastructure that enabled the Khashoggi assassination and the Kushner-MBS relationship that shaped the Trump administration's response to it.[^10] ### Ownership and the Novalpina Deal NSO was acquired by Francisco Partners, a technology-focused private equity firm, in 2014. Francisco Partners's ownership period covered the initial expansion of the Pegasus client base across multiple governments, including the documented deployments in Mexico, Saudi Arabia, and the United Arab Emirates. The Francisco Partners ownership placed a standard private-equity firm in operational control of a cyber-arms company in its portfolio.[^1][^11] In 2019, the co-founders Hulio and Lavie re-acquired NSO from Francisco Partners with funding from Novalpina Capital, a London-based private equity firm founded by Stephen Peel. The Novalpina acquisition valued NSO at approximately 1 billion dollars. The re-acquisition coincided with the period of intensifying scrutiny on NSO's government-client deployments, and the Novalpina ownership became itself a subject of controversy when Novalpina's limited partners raised concerns about the ethical implications of owning a cyber-arms company. Novalpina subsequently underwent its own internal crisis, and the ownership structure of NSO entered a period of documented instability.[^1][^11] The Pegasus Project investigation (July 2021) and the subsequent regulatory and legal pressure (including Apple's lawsuit against NSO, the U.S. Commerce Department's addition of NSO to the Entity List in November 2021, and the WhatsApp v. NSO litigation) have constrained the company's operations. The ownership trajectory from startup to Francisco Partners portfolio company to Novalpina-controlled entity to a constrained and legally challenged operation documents the arc of a private intelligence firm that operated with limited accountability through multiple ownership regimes.[^1][^11] [^1]: For NSO Group founding, ownership history, and the founders' Unit 8200 background, see the published NSO Group documentation and the Wikipedia record. [^2]: "The Pegasus Project." *Amnesty International,* July 2021. https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project-2/ [^3]: "Pegasus: The New Global Weapon for Silencing Journalists." *Forbidden Stories.* https://forbiddenstories.org/pegasus-the-new-global-weapon-for-silencing-journalists/ [^4]: "Where NSO Group Came From and Why It's Just the Tip of the Iceberg." *OCCRP.* https://www.occrp.org/en/project/the-pegasus-project/where-nso-group-came-from-and-why-its-just-the-tip-of-the-iceberg [^5]: "Cyberespionage with Benefits." *Boston Review.* https://www.bostonreview.net/articles/cyberespionage-with-benefits/ [^6]: "Israel Has Turned the Occupied Territories Into a Laboratory for Surveillance." *Jacobin,* July 2023. https://jacobin.com/2023/07/israel-occupation-surveillance-security-state-technology-export [^7]: "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware." *Citizen Lab.* https://citizenlab.ca/research/reckless-exploit-mexico-nso/ [^8]: For the Catalonia (CatalanGate) finding, see the Citizen Lab 2022 CatalanGate report. [^9]: "NSO Group's Continued Surveillance." *Rest of World,* 2022 (El Salvador). https://restofworld.org/2022/nso-pegasus-el-salvador/ [^10]: "NSO spyware used to target family of Jamal Khashoggi, leaked data shows." *The Guardian,* July 18, 2021. https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus [^11]: For the Novalpina Capital ownership deal, see the published NSO Group and Novalpina Capital documentation.