# NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions for Pegasus Spyware Vendor

> An OCCRP/Código Morse/Shomrim investigation, corroborated and published by Citizen Lab, found that NSO Group co-founder Shalev Hulio entered Panama in December 2013 on an Israeli diplomatic passport and told immigration he would stay at the Israeli embassy, days before NSO's Pegasus spyware was sold to the Panamanian government. Citizen Lab researcher John Scott-Railton says the finding raises fresh questions about NSO Group's ties to the Israeli state; Hulio has categorically denied the allegations.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1748
- **ID:** TL-2026-1748
- **Severity:** INFORMATIONAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** NSO Group (Israel)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2016-4655, CVE-2016-4656, CVE-2016-4657, CVE-2021-30860

## Description

On 2026-07-28, Citizen Lab published an analysis of a joint OCCRP/Código Morse/Shomrim investigation (coordinated under the Forbidden Stories consortium framework that also produced the 2021 Pegasus Project) into Panama migration records from Tocumen International Airport. The records show that Shalev Hulio, co-founder and then-CEO of Israeli offensive-cyber vendor NSO Group (legally operating as Q Cyber Technologies), arrived in Panama City on 3 December 2013 aboard a Copa Airlines flight from the United States, entering on an Israeli diplomatic passport and declaring to immigration officials that he would be staying at the Israeli embassy. The visit preceded a 2012-era Pegasus sale to the government of then-Panamanian President Ricardo Martinelli, whose administration was later engulfed in a wiretapping scandal (investigation opened 2014; Martinelli was acquitted on appeal in 2021).

Citizen Lab researcher John Scott-Railton characterized the diplomatic-passport finding as raising renewed questions about NSO Group's connections to the Israeli state — a recurring theme in NSO reporting given that Israel's Ministry of Defense must approve every Pegasus export license, and NSO's founders (Hulio, Omri Lavie, and Niv Carmi) are alumni of Israeli signals-intelligence Unit 8200 and, in Carmi's case, military intelligence and Mossad. Hulio, through representatives, called the allegations of holding a diplomatic passport and acting as a state representative "entirely false and categorically denied." NSO Group did not respond to requests for comment; Israel's Ministries of Defense and Foreign Affairs both declined to comment.

This is a THREAT_ACTOR/attribution-intelligence item, not a vulnerability or active-campaign disclosure: there is no CVE, exploit, or malware payload tied to this specific finding. Its significance is contextual — it adds a documentary data point (a diplomatic passport and an explicit embassy-residency declaration to a foreign government's immigration authority) to a long-running body of reporting, litigation, and sanctions activity establishing NSO Group as a private-sector offensive-actor (PSOA) whose Pegasus spyware has been repeatedly linked to state and state-enabled surveillance of journalists, human-rights defenders, dissidents, lawyers, and government officials across at least 45 countries (per Citizen Lab's 2018 "Hide and Seek" report) and at least 50 countries (per the 2021 Pegasus Project). NSO Group was added to the U.S. Department of Commerce Entity List in November 2021 for enabling transnational repression; a U.S. federal jury found NSO Group liable under the CFAA and CDAFA in the WhatsApp/Meta civil suit, awarding over $167 million in damages in 2025. Hulio stepped down as NSO Group CEO in 2022. This record documents the actor profile, historical exploit chain (Trident/2016, KISMET/2020, FORCEDENTRY/2021), legal and regulatory history, and the new OSINT data point for downstream correlation and actor-tracking purposes.

## MITRE ATT&CK

- T1456 Drive-By Compromise
- T1664 Exploitation for Initial Access
- T1660 Phishing
- T1658 Exploitation for Client Execution
- T1624.001 Broadcast Receivers
- T1404 Exploitation for Privilege Escalation
- T1645 Compromise Client Software Binary
- T1418 Software Discovery
- T1422 System Network Configuration Discovery
- T1422.001 Internet Connection Discovery
- T1422.002 Wi-Fi Discovery
- T1426 System Information Discovery
- T1421 System Network Connections Discovery
- T1429 Audio Capture
- T1512 Video Capture
- T1430 Location Tracking
- T1636.001 Calendar Entries
- T1636.002 Call Log
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1409 Stored Application Data
- T1644 Out of Band Data

## Sources

- [Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport](https://citizenlab.ca/co-founder-of-controversial-spyware-firm-had-israeli-diplomatic-passport/)
- [Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport (OCCRP)](https://www.occrp.org/en/project/the-pegasus-project/co-founder-of-controversial-spyware-firm-had-israeli-diplomatic-passport)
- [FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild](https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/)
- [Hide and Seek: Tracking NSO Group's Pegasus Spyware to Operations in 45 Countries](https://citizenlab.ca/research/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/)
- [The Million Dollar Dissident: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender](https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/)
- [Forensic Methodology Report: How to Catch NSO Group's Pegasus](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/)
- [Pegasus for iOS, Software S0289](https://attack.mitre.org/software/S0289/)
- [Pegasus for Android, Software S0316](https://attack.mitre.org/software/S0316/)
- [US Sanctions Pegasus-maker NSO Group and 3 Others For Selling Spyware](https://thehackernews.com/2021/11/us-sanctions-pegasus-maker-nso-group.html)
- [US Judge Rules Against NSO Group in WhatsApp Pegasus Spyware Case](https://thehackernews.com/2024/12/us-judge-rules-against-nso-group-in.html)
- [NSO Group Fined $168M for Targeting 1,400 WhatsApp Users With Pegasus Spyware](https://thehackernews.com/2025/05/nso-group-fined-168m-for-targeting-1400.html)
- [Apple Drops Spyware Case Against NSO Group, Citing Risk of Threat Intelligence Exposure](https://thehackernews.com/2024/09/apple-drops-spyware-case-against-nso.html)
- ['Somebody has to do the dirty work': NSO founders defend the spyware they built](https://www.washingtonpost.com/world/2021/07/21/shalev-hulio-nso-surveillance/)
- [AmnestyTech Investigations: NSO Group Pegasus IOCs (2021-07-18_nso)](https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1748