One of NSO Group’s founders appears to have gained control of the blacklisted spyware company’s shares after a legal fight over the group’s future, according to corporate filings in Luxembourg. Omri Lavie – the “O” in NSO Group, who in recent years has stepped back from day-to-day management – appears to have emerged as the company’s new majority owner. The Luxembourg filings show that Lavie’s investment firm, Dufresne Holding, is – for now – the sole owner of a Luxembourg-based holding company that ultimately owns NSO Group. The move comes at a time when NSO, which sells one of the world’s most sophisticated cyber weapons, is facing lawsuits by Apple and Facebook in the US and remains on a US blacklist, which prohibits the sale of any US technology to the Israeli group. The Biden administration placed NSO on the so-called “entities list” in 2021, after it said it had found evidence the company had developed and supplied spyware to foreign governments that used the tool to maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers. The move followed publication by the Guardian and other media organisations of the Pegasus Project, an investigation into the company that found dozens of incidents of abuse of the company’s surveillance software by government clients around the world. The project was organised by Forbidden Stories, the French non-profit, and focused on the way the surveillance software has been used by NSO’s clients against journalists. NSO, which is closely regulated by the Israeli ministry of defence, has said it only sells its key surveillance product – a suite of software called Pegasus – to government clients for the purpose of fighting serious crime, such as terrorism, and that it has no control over how a government client uses the surveillance tool once it is sold. The company has also said it investigates serious allegations of abuse by government clients and has said it has cut off clients in the past. When used by a government agency, Pegasus can hack into any phone without leaving an obvious trace, enabling users to gain access to a person’s encrypted calls and chats, photographs, emails, and any other information held on a phone. It can also be used to turn a phone into a remote listening device by controlling its recorder. Surveillance experts at the Citizen Lab at the University of Toronto and Amnesty International have led efforts to track use of the group’s spyware, detecting incidents of abuse against individuals living in Mexico, Morocco, India, Rwanda, Spain, Saudi Arabia, Canada, the United Arab Emirates, France and the UK, among other countries. Sources familiar with the company say Lavie, who has lived in the US, took a back seat at the company in recent years even though he was one of the company’s initial founders. One person familiar with the group’s history said Lavie had argued for the company to have a more US-centric approach and favoured selling the company’s surveillance tools to fewer clients – in the US and Europe. Lavie did not respond to questions from the Guardian. While NSO has faced intense scrutiny in recent years, the company is still considered to be sitting on a lucrative product that is coveted by intelligence agencies and governments around the world. Even the FBI acquired a limited licence for Pegasus in 2019, though it has said it never used Pegasus in its investigations and was merely seeking to study the surveillance software. The Guardian and media partners also reported that talks over a possible sale of NSO to the US defence contractor L3 Harris fell apart last year after the White House said any potential deal would raise “serious counterintelligence and security concerns for the US government”. Lavie’s move follows in the wake of multiple legal fights between NSO and a US-based financial company that is now known as Treo, which controls the equity fund that owns a majority stake in NSO. A person familiar with the matter said Treo had been alerted to the change in ownership of the company’s shares in a recent letter by Lavie, which appears to have caught the financial group by surprise. The person said Treo was still trying to figure out the financial mechanism that Lavie had used to assume control of the shares, but that it believed the company’s financial lenders had, in effect, ceded control of the group to the Israeli founder. A copy of the Lavie letter, which was included in legal filings in Israel, stated that an administrative agent of a 2019 credit agreement involving the Luxembourg holding company (called Northpole) had moved to appropriate the shares in the company to Dufresne – Lavie’s company – on 17 February 2023. “This notice is provided to you for the sake of good order,” said the letter, which was signed by Lavie and sent to representatives of Treo. In a statement to the Guardian, Treo said the lenders had “seemingly organised a foreclosure under their loan agreements”. “This follows NSO’s failure to meet its financial obligations since 2021, the need by lenders to provide additional financing to keep the company afloat in 2022, and repeated attempts to sell the company that have all failed,” Treo said. Treo also said its fund had “consistently been denied even basic corporate information by NSO and its founders, including information related to the company’s compliance with US laws; whether Pegasus spyware continued to be sold to elevated risk customers; and what the company had done to address allegations of widespread misuse of its products”. NSO did not immediately respond to a request for comment. The Israeli news outlet Calcalist first broke the story. It reported that a district court in Tel Aviv had been alerted that the spyware company’s lenders had transferred the company’s shares to a new holding company, whose sole shareholder was Lavie. It also suggested, however, that additional directors would be named once a new group of investors were fully onboard.