Will spyware maker NSO Group's struggles reduce use of its eavesdropping tech? Critics doubt it.

The company announced layoffs and a reorganization on Sunday, but spyware researchers doubt that will reduce the use of its technology.

Embattled Israeli spyware vendor NSO Group announced a major reorganization Sunday — replacing its longtime CEO and laying off roughly 100 of its 700 employees — but experts who track the growing trade in surveillance technology say that’s unlikely to curtail deployment of the company’s technology designed to secretly monitor its targets.

“Such changes will not address the ongoing absence of accountability,” said Claudio Guarnieri, the head of Amnesty International’s Security Lab, one of several organizations that has tracked and exposed global digital surveillance enabled by NSO Group’s spyware technology.

“The piling discoveries of unlawful surveillance of activists, journalists and other members of civil society show a rotten mercenary spyware industry, and a moratorium of their sales is as urgent now as ever,” Guarnieri told CyberScoop.

NSO Group has been under increasing pressure after repeated reports of autocratic governments using the firm’s technology to target political opponents, journalists and activists. The U.S. government in November blacklisted the company — along with Candiru, another Israeli spyware firm — several months after an international consortium of researchers and journalists exposed widespread abuses involving the company’s technology.

The designation reportedly put a heavy financial strain on the company, and at least one potential U.S. acquisition, by technology firm L3Harris, fell through after pressure from the U.S. government, The New York Times reported in July.

Shortly after the designation, Apple announced a lawsuit against the company, claiming that it had abused Apple’s services and platforms to target victims around the world.

The company did not immediately respond to a request for comment Monday, but told The Washington Post Sunday that the resignation of CEO Shalev Hulio was part of a broader reorganization that includes plans to market the firm’s cutting-edge technology to NATO countries.

The firm “will examine all aspects of its business, including streamlining operations to ensure NSO remains one of the world’s leading high-tech cyber intelligence companies,” the company said in a statement to the Post.

The company’s woes have been apparent for some time and it has limited options, said John Scott-Railton, a senior researcher with the Toronto-based Citizen Lab, one of the organizations investigating the use of NSO Group technology.

“NSO’s business strategy these days seems to be: hold on and hope for an acquisition miracle, or a change of government,” Scott-Railton told CyberScoop Monday. “We’ve heard for months that they are running low on cash, and big layoffs and a shakeup seem to speak to that.”

He added that he expects it will be business as usual for the NSO Group, though, because “NSO supplies problematic customers, who will keep doing bad things with the tech.”

Scott-Railton is also skeptical that the company’s announced reforms will amount to much.

“NSO’s short corporate history is littered with reorganizations that weren’t, diligence that wasn’t turnarounds that didn’t, and reforms that went nowhere,” he said. “I don’t see any reason this will be different.”

More broadly, however, NSO may serve as a cautionary tale for the myriad other spyware vendors around the world hawking their wares. “Spyware tech is a risky investment,” Scott-Railton said. “Investors don’t usually line up to get wiped out.”

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Google and Amnesty International teamed up to make it harder for spyware vendors to hide

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems