Tracking New Entrants in Global Spyware Markets

Tracking New Entrants in Global Spyware Markets notes that spyware’s proliferation continues to threaten human rights and national security, with NSO Group recently fined $168 million in punitive damages by a US court for targeting WhatsApp’s infrastructure with Pegasus.

According to the Atlantic Council’s Cyber Statecraft Initiative, the number of US-based investors in spyware companies surged in 2024, with the first Mythical Beasts report covering 1992–2023 identifying twelve entities, and the second edition adding twenty new US-based investors for a total of thirty-one, pushing the United States to the top of the investor leaderboard.

The piece highlights substantial US investment despite policy measures such as the Entity List and export controls, citing deals like AE Industrial Partners’ late-2024 investment in Paragon Solutions Ltd and Integrity Partners’ financing of Saito Tech Ltd (Candiru). It also brings attention to resellers and brokers who obscure connections between vendors, suppliers and buyers, including ten historically overlooked intermediaries in Mexico involved in Pegasus sales to government clients.

The updated findings reiterate six defining trends—geographic concentration in Israel, India and Italy, recurring entrepreneurial ventures, and partnerships between spyware and hardware-surveillance vendors—while calling for greater regulatory visibility into reseller networks to counter spyware proliferation.