NSO Group

NSO Group is an Israeli spyware company and private sector offensive actor known for developing and selling Pegasus spyware; it is also referred to as NSO, nso_group, Pegasus, and Q Cyber Technologies. Microsoft maps NSO Group to Night Tsunami (formerly DEV-0336) in its private sector offensive actor taxonomy. The company is repeatedly described as the maker of Pegasus, a surveillance platform and remote access trojan used to target mobile devices, including iOS, Android, and BlackBerry, and capable of extracting messages, calls, photos, location data, contacts, browser history, and other device data, as well as activating cameras and microphones. The content states that NSO sells packaged hacking solutions or access-as-a-service capabilities to government customers. The content directly links NSO Group to multiple Pegasus delivery vectors and campaigns. WhatsApp publicly attributed the 2019 exploitation of CVE-2019-3568 to NSO Group, in which specially crafted WhatsApp calls enabled zero-click installation of Pegasus against approximately 1,400 users. Court filings and testimony described NSO using WhatsApp infrastructure, malicious signaling traffic, and follow-on servers to deliver Pegasus, and indicated continued development of WhatsApp-related vectors after the lawsuit, including Eden, Heaven, and Erised, collectively referred to as Hummingbird. The content also attributes iMessage-based Pegasus activity to NSO Group with high confidence, including the FORCEDENTRY exploit chain exploiting CVE-2021-30860 to deliver Pegasus via zero-click messages. Additional reporting in the content describes an NSO-associated “MMS Fingerprint” technique that used MMS notification behavior to fingerprint target devices without user interaction. The actor is associated in the content with phishing and social engineering as well as zero-click exploitation. Multiple reports state that Meta and WhatsApp detected and disrupted new NSO-linked spear-phishing or one-click phishing campaigns targeting WhatsApp users despite a permanent injunction barring NSO from targeting WhatsApp and its users. Reported activity included malicious links redirecting users to external websites, creation of WhatsApp test accounts and groups, and targeting of a small number of users, including users in Jordan and Lebanon. WhatsApp and Meta published related domains including ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com. Earlier Pegasus operations in the content also used SMS phishing and other deception-based lures. Targets directly mentioned in the content include journalists, human rights defenders, activists, lawyers, political dissidents, diplomats, senior foreign government officials, humanitarian workers, military personnel, and other civil society members. Citizen Lab reporting cited in the content identified more than 100 cases of abusive targeting of human rights defenders and journalists in at least 20 countries linked to the 2019 WhatsApp incident. The content also references documented targeting in countries including Bahrain, Saudi Arabia, Mexico, Morocco, Canada, Jordan, Lebanon, and others. The content states that NSO Group has faced significant legal and policy action. WhatsApp and Facebook sued NSO Group and Q Cyber Technologies in 2019 over the WhatsApp attacks; a court found NSO violated U.S. hacking laws, a jury awarded roughly $167.25 million in punitive damages plus compensatory damages, and a permanent injunction barred NSO from targeting WhatsApp and its users. Apple also sued NSO Group, alleging Pegasus was used to attack a small number of Apple users worldwide. The U.S. government placed NSO Group on the Entity List in 2021, and the content says the blacklist was tied to activity contrary to U.S. national security and foreign policy interests and to widespread Pegasus abuse. The content also notes that Amazon shut down accounts linked to NSO Group after Amnesty International disclosed Pegasus-related domains.