U.S. sanctioned NSO Group in 2021. By 2025, 4 successor firms had filled the same market. Here is the chain.
When the U.S. Department of Commerce added NSO Group to the Entity List in November 2021, it was framed as a structural blow against the commercial-spyware industry. Four years later, the same buyers (governments) are buying the same product (mobile-device exploitation) from a different cluster of vendors. Citizen Lab, Amnesty International, and the European Parliament's PEGA committee have documented who replaced NSO and who is buying from them.