The Pegasus cash box was in Luxembourg: zero employees and USD 209.8 million in one year

In 2020, a company in Luxembourg declared not a single full-time employee and billed USD 209,791,558. Its name is Q Cyber Technologies, and it is the subsidiary of NSO Group, the Israeli maker of the Pegasus spyware, that handled the group’s sales outside Israel: it signed the contracts, issued the invoices and collected the payments.

Pegasus is the program that infected the phone of Spain’s prime minister, Pedro Sánchez, as the Spanish government itself confirmed in May 2022, and the phones of journalists in Mexico, according to Citizen Lab and the Mexican organization R3D.

The Q Cyber figures are in an expert report that Irídia, the Center for the Defense of Human Rights, filed on November 6 with the Barcelona Court of First Instance. Irídia is a private prosecutor in the case over the Pegasus hacking of lawyer Andreu Van den Eynde, one of the cases of the so-called Catalangate. According to the organization, the lawyer’s phone was infected in May 2020. The report was prepared by an international nonprofit organization that specializes in corporate and financial structures, and it analyzes the group in 2019 and 2020.

A subsidiary with almost no workers

According to the expert report, Q Cyber declared one full-time equivalent employee in 2019 and none in 2020. It billed USD 229,839,361 in 2019 and USD 209,791,558 in 2020, according to its accounts in the Luxembourg business register. Using the Bloomberg News figures cited in the report, those amounts are equivalent to 79% of all of NSO Group’s revenue in 2019 and 93% in 2020. These are sales of the whole group, not only of Pegasus.

The report adds that the subsidiary apparently carried out its operational work through related or subcontracted companies. It also cites how Yaron Shohat, NSO Group’s former chief executive, put it in WhatsApp’s lawsuit against NSO in the United States, when he was asked whether it mattered if a Pegasus contract was signed by Q Cyber or by NSO in Israel: he answered that it did not really matter, that it mattered to the accountants and the finance team because it meant more work, but that NSO did not really care which entity signed the contract.

The contracts it signed

The expert report identifies three cases, in court or government documents, in which Q Cyber appears as the seller:

• A Pegasus end-user license dated November 11, 2018, with a client whose name is redacted, in the documents of WhatsApp’s lawsuit against NSO.
• A June 2020 tender document for the sale of an IMSI catcher and a web intelligence platform to Brazil’s Federal Police in São Paulo.
• A November 2020 agreement with Poland’s National Prosecutor’s Office to sell Hermes, an NSO Group surveillance system, according to Poland’s Supreme Audit Office.

The report also cites the 2023 final report of the European Parliament committee that investigated Pegasus (PEGA): according to the committee, Hungary’s Interior Ministry bought Pegasus in 2017 for EUR 6 million, indirectly, through Communication Technologies Ltd, from NSO Group’s company in Luxembourg.

Who was in charge in Luxembourg

The other Luxembourg subsidiary, OSY Technologies, was the group’s main holding company. From September 2019, a committee of its board, the Governance, Risk and Compliance Committee (GRCC), audited clients on human rights and, according to the group itself, had to approve sales and could reject them or attach conditions to them. It also investigated reports of misuse of Pegasus. According to Irídia, there are indications that this committee reviewed the Catalangate spying, but the case file contains no NSO investigation into the case.

According to the expert report, the three executives under investigation held positions in those two companies:

• Shalev Hulio, co-founder of NSO and its chief executive until August 2022, was a director of OSY (from April 2019 to February 2023) and of Q Cyber (from July 2019 to February 2023).
• Omri Lavie, a co-founder, was a director of OSY (from April 2019 to October 2025) and, after the period under investigation, of Q Cyber (from February 2023 to October 2025).
• Yuval Somekh was a director of Q Cyber (from January 2016 to November 2021) and of OSY (from August 2018 to September 2021), and the group’s vice president of business operations and chief financial officer for Europe.

According to Irídia, between them the three held management positions in eight of the group’s Luxembourg companies, and no one else accumulated so many roles in so many companies.

Servers to Mexico and Indonesia

Between 2020 and 2023, Q Cyber is listed as the sender of 26 shipments to Indonesia and Mexico on two commercial data platforms: mostly servers, monitors, routers and rack mounts, shipped from Luxembourg, the Netherlands, the United Kingdom and Japan to resellers or authorities in those countries. One of them, from March 2023, was addressed to Indonesia’s Corruption Eradication Commission (KPK).

The expert report makes clear that those shipments do not prove that Pegasus was exported. It considers them relevant because several descriptions mention equipment allegedly used, among other things, in the infrastructure for deploying Pegasus, and because the governments of Mexico and Indonesia allegedly deployed Pegasus after receiving them. Based on that data, it concludes that Q Cyber was partly involved in distributing Pegasus.

Poland: the network was run by the manufacturer

In October, Poland’s National Prosecutor’s Office reported that, according to an expert analysis by the country’s Internal Security Agency (ABW), the network that transmitted Pegasus data was run by the manufacturer and the data left the country. Its spokesperson clarified that the analysis does not determine whether NSO accessed specific cases.

Using documents from other court and administrative proceedings, Irídia’s expert report concludes that the group could access the data extracted from the phones. NSO has always denied this: its representatives maintain that neither its companies nor its employees nor its executives are directly involved in the way clients use Pegasus.

“Judicial paralysis”

In the Barcelona case, Hulio, Lavie and Somekh and three group companies, NSO Group Technologies, OSY and Q Cyber, are under investigation for alleged crimes against privacy. Paz Esteban, the former CNI director, is under investigation in the same case. Being under investigation does not mean being charged or convicted. Esteban denied before the judge, in December 2025, that the CNI had spied on the lawyer, according to EFE.

Irídia filed the expert report “in the face of judicial paralysis.” According to the organization, Luxembourg’s judicial authorities asked the Barcelona court for information six times, got no answer and closed the European Investigation Order, as Vilaweb reported in March. Irídia had already submitted another expert report in November 2024, which identified the three executives, and it says it is once again leading the investigation “in the face of the manifest passivity of the Public Prosecutor’s Office.”

One question remains: how does a company that declares not a single full-time employee bill USD 209.8 million in one year?

Spot an error? Write to me and I will correct it with a footnote.