Serious question, if the NSO group is actively creating spyware - how have we not sanctioned them?
Heck this would probably need to be escalated to threaten the host country of the company with consequences if they're giving safe haven to a known bad actor.