Irídia submits an international expert report placing NSO Group’s Luxembourg companies and their executives at the centre of Pegasus sales and control

• In the face of judicial paralysis, the organisation has submitted a second expert report in the case concerning the Pegasus spying on a lawyer. It was prepared by an international organisation specialising in corporate investigations.
• According to the report, the two Luxembourg companies played a necessary and active role both in marketing Pegasus outside Israel and in controlling its use.
• Irídia is also publishing an update to its investigation into NSO Group as a gateway for Israeli technology into Europe (2010–2026).

Barcelona, 6 November 2026 — Irídia has submitted a new expert report to the Barcelona Court of First Instance in the case concerning the Pegasus spying on a lawyer. The lawyer’s phone was infected in May 2020. The report was prepared by an international non-profit organisation specialising in investigating corporate and financial structures.

The new expert report analyses NSO Group’s network of companies during 2019 and 2020. It focuses on the role of the two Luxembourg subsidiaries under investigation, OSY Technologies and Q Cyber Technologies, and on that of the three executives under investigation: Shalev Hulio, Omri Lavie and Yuval Somekh. The report Irídia is submitting today builds on the expert evidence it submitted in November 2024. Thanks to that evidence, the group’s three executives were identified and placed under investigation in the case.

With this new report, Irídia once again provides information about the companies and individuals involved in the spying. The report examines the three companies under investigation and the three executives who held management positions in them. It looks in depth at the role each played in relation to Pegasus and sets out evidence on the extent to which all parties took part in the infection process. It also presents NSO Group’s corporate structure in Luxembourg as an active and necessary part of the group’s operations, and links it to NSO Group in Israel.

“Once again, as the party bringing the case on behalf of the victim, and in the face of the Public Prosecutor’s Office’s evident inaction, we are forced to lead the investigation into the Pegasus spying. We are submitting an unprecedented international expert report that shows that OSY exercised control before and after Pegasus was sold, that Q Cyber managed its marketing outside Israel, and that Hulio, Lavie and Somekh held a unique position within the group. With this report there are no more doubts or excuses: it is time for these companies and their executives to answer before the Spanish courts and for all relevant liability to be established,” said Brian Ventura, Irídia’s lawyer.

Who did what in NSO Group’s corporate network

The documentation submitted defines the role of each of the three companies under investigation in the case as follows:

• NSO Group Technologies (Israel) developed, manufactured and maintained Pegasus.
• Q Cyber Technologies (Luxembourg) acted as commercial distributor and was the contracting party in Pegasus sales outside Israel.
• OSY Technologies (Luxembourg) audited clients before each sale and investigated cases of so-called “misuse” of Pegasus.

As for the three people currently under investigation in the case, Shalev Hulio, Omri Lavie and Yuval Somekh, the documentation attributes to them a unique role within the group. During the period under investigation (2019–2020), no one else in the corporate network held so many roles in so many of the group’s companies.

Main findings of the report

OSY was not just a holding company: it could veto the group’s sales, including of Pegasus.
As well as holding shares in them, OSY financed the group and provided management services to other companies. In September 2019, its board of directors set up the Governance, Risk and Compliance Committee (GRCC) to oversee the group’s human rights programme. This committee carried out human rights audits of clients. According to the group itself, the GRCC had to approve sales and could reject them or attach conditions to them. Once a sale had been made, it oversaw investigations into complaints that clients had misused the products.

According to the report, there are indications that the GRCC reviewed the spying in the Catalan Gate case, in which Irídia is acting as private prosecutor, because it received a great deal of media attention. However, the case file contains no record of any NSO Group investigation into this case.

A subsidiary with almost no employees accounted for up to 90% of the group’s sales.
Q Cyber Technologies is NSO Group’s sales, marketing and distribution entity for markets outside Israel. It reported sales revenue of approximately 230 million dollars in 2019 and 210 million in 2020. According to the report’s estimates, this represents 80% and 90% of the group’s total, respectively. The subsidiary reported a single full-time-equivalent employee in 2019, and none in 2020.

The three people under investigation concentrated the ownership, administration and management of the group.
Between them, Hulio, Lavie and Somekh held directorships in eight of the group’s Luxembourg companies. According to the report, no one else in the group acted in so many roles or in so many different companies.

NSO Group retained at least partial control of Pegasus and could access data from infected phones.
Based on documentation reviewed from other judicial and administrative proceedings, the report concludes that the group could access the data extracted from the devices. The report therefore once again points to NSO Group’s participation, involvement and knowledge in its clients’ use of Pegasus, something the group has always denied.

How the network operates today, after 16 years of scandals

Irídia is also publishing an annex to the investigation Gateways for genocide technology into Europe, an investigation by the Observatory on Human Rights and Business in the Mediterranean (a project of Novact and Suds) and Irídia. The annex, entitled The case of NSO Group (2010–2026) as a gateway for Israeli technology into Europe, argues that the corporate network has managed to survive and adapt to sixteen years of scandals. To do so, it has relied on the protection of and collaboration with the Israeli government, on an opaque corporate structure with its European hub in Luxembourg and, more recently, on a change of ownership in the United States, despite the sanctions imposed on the corporate group and its employees in 2021.

The annex, available in Catalan, Spanish and English, identifies the modus operandi and the strategies the group has followed over the years to keep growing, despite rulings against it, the imposition of sanctions and the dozens of ongoing investigations into the use of Pegasus, including the one brought by Irídia. The annex highlights the following strategies:

• A technology tied to the State of Israel. Pegasus was born out of Israeli military intelligence expertise, and Israel has used it as a diplomatic bargaining chip.
• Tested in Palestine, used against dissent around the world.
• Luxembourg, the gateway to Europe. NSO has nineteen companies there, and this structure also helps it pay less tax: in 2026, an Israeli court convicted the group of fraud for failing to pay tax in Israel on 86 million dollars in profits.
• An image to rebuild. Since 2023 it has been collaborating with the Israeli government. In 2025 it passed into the hands of US investors, led by Trump’s former ambassador David Friedman, in an attempt to return to the US market.