Israeli company NSO Group, known for its Pegasus spyware, is going through a new stage in its turbulent history. According to Israeli business media Calcalist Tech, a consortium of American investors led by Hollywood producer Robert Simonds is about to take control of the company. Discussions, which have been in progress for several months, would involve an investment of “several tens of millions of dollars” and would require the approval of Israel’s defence export regulator. NSO Group spokespeople confirmed to several US media outlets, including TechCrunch, that a group of US investors had indeed injected funds and obtained a controlling stake, without specifying the exact terms.
This possible takeover would be part of an older story: Simonds had already put one foot in the group’s organisation chart in 2023, by becoming a director of Dufresne Holding, the Luxembourg holding company that oversees NSO’s holding structure. That same year, he also explored a takeover bid, which was not taken up. The episode sheds light on the current transaction: it would extend a long-term strategy rather than a stroke of opportunity.
This change in governance, if it materialised, would mark a turning point for a company under financial and political strain. Blacklisted by the United States since 2021 for its surveillance activities deemed abusive, NSO Group is seeking to recapitalise and improve its image. It has confirmed that its operational headquarters will remain in Israel, and that its activities will continue to be supervised by the Israeli Ministry of Defence. The arrival of American capital is intended to stabilise the company and reopen the door to certain commercial cooperation with Washington, while maintaining strict Israeli supervision of its sensitive technological exports.
Luxembourg is playing a discreet but strategic role in this restructuring. NSO Group is owned by a number of cascading Luxembourg entities: Osy Technologies, NorthPole Newco and Dufresne Holding, all domiciled at 44, rue de la Vallée in Luxembourg. These companies form the financial structure that indirectly controls NSO Group. The accounts filed with the Registre de Commerce in 2025 for 2024 show a highly leveraged architecture: more than one billion dollars of consolidated debt, negative equity and an activity limited to holding financial assets and intra-group loans. Osy Technologies, the subsidiary closest to the Israeli assets, has negative equity of €272 million, while NorthPole Newco alone has bank debt of more than €700 million. Dufresne Holding, the lead company, holds only a symbolic asset of around 140,000 euros and closes 2024 with a loss of one million euros.
This fragility reflects the financial complexity of a group whose value is based on technological assets subject to strong regulatory constraints. Since 2023, the Luxembourg holding company has acted as a takeover vehicle for the group’s creditors, confirming that effective control of NSO Group has shifted from its Israeli founders to its financial backers.
At the same time, an emblematic court case has concluded in the United States. The US District Court for the Northern District of California upheld NSO Group’s liability for the unauthorised exploitation of WhatsApp messaging, used by Pegasus to infect devices. However, Judge Phyllis Hamilton drastically reduced the damages: from more than $167 million, the fine was reduced to around $4 million, along with an injunction prohibiting NSO Group from using WhatsApp in the future. This spectacular reduction raises questions about the deterrent effect of sanctions against the cybersurveillance giants.
To counter its sulphurous image, NSO Group is highlighting its 2024 transparency and responsibility report, presented as a pledge of openness. The document claims a “rigorous” compliance policy and states that Pegasus is only accessible to government agencies, under licence from the Israeli Ministry of Defence. The company claims to have worked with around sixty public-sector clients since its creation, twenty of which were still active in 2024. Eleven cases of alleged abuse were examined: four licences were suspended, two revoked and five investigations are still underway. NSO Group also mentions the development of new “defensive” solutions, in particular a detection tool called Eclipse, designed to warn of state threats.
But the same report admits a 15% drop in sales over the year, as a direct result of US sanctions and the termination of several contracts. The company, which employs around 650 people, admits that its survival depends on diversification and support from new investors.