NSO Group was founded in late 2009 by serial entrepreneurs with ties to the Israeli government.
Headquartered in Herzelia, Israel, NSO Group was founded in Dec. 2009 by Omri Lavie and Shalev Hulio, according to both cofounders' LinkedIn profiles, which show they are both serial entrepreneurs who had previously started a number of other companies in Israel. A third founder, Niv Carmi, left the company shortly after its inception and left Lavie and Hulio as majority shareholders.
The San Francisco-based private equity firm Francisco Partners acquired a majority stake in NSO for $120 million in 2014, though its operations remain in Israel.
Hulio says on his LinkedIn profile he was a company commander with the Israel Defense Forces, while Lavie says he was an employee of the Israeli government.
At least three of its current employees claim to have worked in Unit 8200, Israel's version of the US National Security Agency.
It's hard to figure out what the company actually does — but its website offers some clues.
The company describes what it does on its website as such:
"We develop technology that enables government intelligence and law enforcement agencies to prevent and investigate terrorism and crime. We provide the tools that support official authorities to lawfully address the most dangerous issues in today's world. Governments use our products to prevent terrorism, break up criminal operations, find missing persons, and assist search and rescue teams."
NSO currently employs more than 230 people, according to its numbers on LinkedIn. That's more than double the head count it had two years ago.
The company's specialty is "the field of cyber warfare."
A brochure from the company, uploaded online by Privacy International, gives more insight into what it really does: Offer mobile hacking solutions for a variety of phones exclusively for the use of governments, law enforcement, and intelligence agencies.
NSO Group says it is "a leader in the field of cyber warfare" that utilizes its proprietary monitoring tool called "Pegasus," which can monitor and extract all data from a target "via untraceable commands" which allow "remote and stealth."
Its software is purchased by governments all over the world for millions of dollars.
Its clients have reportedly included Panama and Mexico, though a person familiar with the company told the Wall Street Journal it does business all over the world.
NSO received $8 million from Panama's government for its Pegasus spy software, according to a local press account. And with 2016's research from Citizen Lab documenting an attack on Ahmed Mansoor, a human rights activist living in the United Arab Emirates, it's likely that government has purchased the software as well.
The company's annual earnings were approximately $75 million in 2015, according to Reuters.
NSO's 'Pegasus' spy tool transforms a variety of phones into mobile listening stations.
NSO showed off demonstrations of its mobile phone hacks on a BlackBerry, iPhone, and Android phones in 2013, according to leaked emails from a breach of Hacking Team, a competitor of the company based in Italy.
"Your smartphone today is the new walkie-talkie," NSO cofounder Omri Lavie told the Financial Times that year. "Most of your typical solutions for interception are inadequate, so a new tool had to be built."
Pegasus can infect a targeted phone in two ways, both of which are through SMS text messaging. Its "zero-click" vector allows an attacker to send a special SMS message to a target which causes the phone to automatically load a malicious link, while its "one-click" vector requires a user to click a link to infect their device, which happens in the background without a user ever knowing.
Once infected, spies can actively record with the phone's microphone or video camera, grab personal data like calendars, contacts, and passwords, or download all the data on the device, to include emails, photos, and browsing history.
"We're a complete ghost," Lavie told Defense News in 2013. "We're totally transparent to the target, and we leave no traces."
There's speculation that Jeff Bezos' phone was hacked using tools very similar to those created by NSO.
The Amazon CEO's phone was famously hacked earlier this year, exposing intimate texts and pictures he exchanged with Lauren Sanchez, the woman with whom he was having an affair.
In a March op-ed in the Daily Beast, Bezos' security consultant said his team concluded that Saudi Arabia "had access to Bezos' phone and gained private information." He stopped short of asserting how Saudi Arabia might have accessed Bezos' phone, but he linked out to a New York Times article on "internet mercenaries" including NSO Group, DarkMatter, and Black Cube.
The WhatsApp exploit reportedly enabled NSO Group's Pegasus software to be installed on iPhone and Android smartphones through a WhatsApp phone call.
The Financial Times reported on Monday that, through a WhatsApp exploit, malicious actors could install NSO Group's Pegasus software simply by calling their target within WhatsApp.
The phone call didn't need to be picked up, and a call log could even be remotely erased after the fact. If successful, the target's phone data could be accessed — everything from call logs to location data.
The NSO Group denied its involvement in the WhatsApp exploit, though that doesn't preclude the possibility that someone else used NSO's products to exploit the WhatsApp security hole.
A representative for WhatsApp told the FT that the attack "has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems."
A separate statement from a WhatsApp representative sent to Business Insider encouraged WhatsApp users to update to the latest version of the app, which patches out the security flaw:
"WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices. We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users."
Paul Szoldra contributed to a previous version of this report.
