According to recent articles I’ve read this may not be the case. Apparently at least one organization has accused NSO of doing the unlawful accessing.

Standby while I look for a source.