Cash-strapped Pegasus spyware developers wanted to sell to 'red-flag' countries

Expenses and loan repayments have hampered Pegasus developer NSO Group from the start, and even before US blacklisting, the company reportedly looked to sell the spyware to countries it knew would abuse it.

NSO CEO Shalev Hulio has previously insisted that law-abiding citizens have nothing to be afraid of from his company's Pegasus spyware. Nonetheless, Pegasus has been used to spy on EU officials, including the Spanish Prime Minister.

Now a new report from the Financial Times claims that at one point in 2021, the company was in extreme financial disarray, and CEO Hulio proposed a solution. He wanted to sell Pegasus to firms he reportedly described as risky.

Specifically, he proposed ignoring his own company's "elevated risk" descriptions of countries, and instead sell to them to get cash in quickly enough to pay salaries and address its debts.

Hulio is said to have suggested this when the independent Berkeley Research Group (BRG) had been brought in by investors whose equity fund held a majority stage in NSO. BRG's job was to close down the fund following separate issues.

"You are demanding that (BRG) blindly sanctions the sale of... Pegasus... to elevated risk customers without a thorough governance review," BRG lawyers wrote on December 13, according to the Financial Times. "Please note that in no circumstance is (BRG) prepared to do so."

BRG did, however, make a $10 million loan to NSO to cover its payroll. The loan was specifically made to an NSO subsidiary that makes a drone defense system, but it was used to make payroll.

It has been reported previously that the NSO Group's finances were such in December 2021 that it was considering killing off its Pegasus system. This followed Apple suing the company in 2021, though it reportedly also followed the FBI buying the spyware in 2019.

Subsequently, the US government blacklisted the NSO Group in late 2021. According to the Financial Times, the NSO has tried many times to argue its case with the Department of Commerce, but appears to have not yet managed to meet with officials.

"It is critical for direct policymaker engagement to provide a greater understanding of how our technologies work, the countless lives it has saved and the specific steps the company takes to prevent misuse and terminate contracts when misuse is determined to have occurred," the NSO told the publication.

Unspecified sources have told the Financial Times that the company is currently looking at what it calls a "phoenix plan." It may split the company into two, where the engineers and Pegasus software code would be in one entity.

If executed, NSO Group's riskier clients, the ones causing the US blacklist, would be separated from the rest of the firm.

While declining to comment directly on its attempting to gain waivers from the US government, the group also said that its systems are in "high demand." It says that the company employs a particularly thorough "due diligence process" over who it sells to.