Commerce Department blacklists controversial spyware company NSO Group

Candiru and Russia-based Positive Technologies were also included in the announcement.

The Commerce Department Wednesday added two Israeli spyware companies, NSO Group and Candiru, to its entity list of companies that pose a national security and foreign policy risk to the United States.

The designation accuses both NSO Group and Candiru of having “developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, business people, activists, academics, and embassy workers.” Inclusion on the list enacts stringent licensing requirements for exports to designated companies from U.S. businesses. Companies previously included on the list include Chinese firm Huawei, which the U.S. government has flagged as posing a risk to Americans’ data.

Also added to the entity list Wednesday were Russia-based Positive Technologies and Singapore-based Computer Security Initiative. The Commerce Department accused the two companies of trafficking “cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.” The U.S. Treasury Department sanctioned Positive Technologies in April for allegedly supporting Russian government espionage.

Many of the accusations about the spyware vendors come after a plethora of research by human rights and privacy experts, who have linked NSO Group and Candiru technology to spying on dissidents, journalists and human rights advocates by authoritarian regimes.

For instance, this summer the “Pegasus Papers” consortium led by Amnesty International found that NSO Group’s Pegasus spyware was actively exploiting iPhones to target more than three dozen victims. A Citizen Lab report in July tied Candiru to more than 750 websites posing as human rights organizations.

“NSO Group is dismayed by the decision given that our technologies support US national security interests and policies by preventing terrorism and crime, and thus we will advocate for this decision to be reversed,” a representative for the company wrote in an email to CyberScoop.

Candiru could not be reached for comment.

Amnesty International and the United Nations have called for a moratorium on spyware technologies until nations reach an agreement on an international human rights framework. Groups have also called for Israel to halt the export of NSO Group’s technologies. Israel committed to investigating allegations against NSO Group after the French president’s personal phone number was exposed in the documents uncovered by the Pegasus Project.

The Israeli embassy did not immediately respond to a request for comment.

“I think it’s a signpost that the U.S. government recognizes the threat posed by a surveillance industry that is wildly out of control and while the NSO Group has been at the forefront, certainly there are other companies that are at play,” said Danna Ingleton, deputy director of Amnesty Tech.

Action from the United States could also put pressure on how other governments deal with the company.

“I think we’ve seen the first signals of what could be a bit of a corrective for the out-of-control market place and countries will have to choose if they want to be a part of this direction,” said John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab.

While Israel has claimed that NSO Group’s offerings are regulated per its guidelines for its other cybersecurity exports, human rights advocates haven’t been satisfied by the country’s answers.

“I think it’s an eye-opener for Israeli regulatory systems or any country regulating the spyware industry that lip service isn’t sufficient and there needs to be greater transparency in how these companies are regulated,” said Ingleton.

Ingleton said Amnesty will continue to push for a global moratorium and for justice for victims of NSO Group’s spyware.

The designation, which will limit the NSO Group from the U.S. technologies it has relied on in the past, could also hurt its bottom line. The blacklisting could go a long way in slowing NSO Group’s growth and have “a chilling effect on investors,” said Railton.

Updated 11/3/2021: To include additional comment from NSO Group, John Scott-Railton and Danna Ingleton.

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia…

Someone infected a spyware probe overseer with spyware

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems