Who watches the watchmen? Surveillanceware firms make bank, avoid oversight

This report surveys the growth and normalization of the surveillanceware industry, highlighting escalating prices for exploits and “spyware-as-a-service,” persistent government demand, and recurring abuses targeting journalists and activists. It cites examples involving FinFisher (Gamma Group), Hacking Team, Candiru, NSO Group, Paragon, and rebranding tactics (e.g., Amesys to Nexa/AMESys) used to obfuscate operations, alongside limited-impact responses such as US sanctions and the Pall Mall Process. Researchers also note spillover into wider threat activity—such as Russia’s Cozy Bear leveraging spyware-related flaws—while vendors increasingly use stealthier TTPs (zero-days, zero-clicks, resilient C2), underscoring the lack of effective safeguards.