# NSO Group ## Identification NSO Group is the owner-supplied normalization associated with the notebook phrase “RT Buddy.” Bryant McGill states that the RT Buddy/Pegasus identification arose from log observations involving [[CrashCapture|CrashCapture]] or [[Heimdallr|Heimdallr]], particularly documented resources visible in those logs. He also states that Pegasus heuristic matches alone mean nothing as proof and that “Pegasus” is a clumsy cover for something else to be detailed later; the notebook page alone does not independently establish the normalization or attribution. ## Scanned_20260730-1314 evidence In [[Scanned_20260730-1314|Scanned_20260730-1314]], PDF page 12, this term appears in the notebook’s reconstruction and relationship map. See [[Scanned_20260730-1314#Scanned_20260730-1314.pdf — PDF page 12|page 12]]. ## Evidentiary status The notebook occurrence establishes research context and page-level proximity. It does not alone prove ownership, installation, account use, employment, partnership, attribution, or operational deployment. ## RT Buddy / Pegasus observed-log context **Owner-supplied observation:** Bryant McGill states that the RT Buddy/Pegasus identification arose when the relevant activity or resources appeared in logs together with [[CrashCapture|CrashCapture]] or [[Heimdallr|Heimdallr]], particularly through documented resources visible in those logs. The preserved logs are the cited observational basis. This records what was observed; it does not by itself establish that every Apple RTBuddy service reference is Pegasus, nor does page or log proximity alone prove infection, control, authorship, or attribution. ## Pegasus heuristic caution **Owner-supplied interpretation:** Bryant McGill states that finding Pegasus heuristics, standing alone, means nothing as proof of the underlying system or attribution. In his interpretation, “Pegasus” is a very clumsy cover for something else, which later documents in this archive will detail. Until those materials are incorporated, heuristic matches must not be treated as proof of Pegasus infection, NSO Group attribution, or final identification of the underlying mechanism. ## Scanned_20260730-1946 overlay RT Buddy occurs on PDF pages 5 and 8 and is linked to NSO Group only through the vault owner's cumulative identification. The written pages themselves do not name NSO Group. Their strongest additional contribution is the subsequent mobile reverse-engineering workflow on pages 17–18. Attribution requires preserved artifacts, hashes, timestamps, process/bundle identity, device/build context, runtime/network evidence, and corroboration. The stated owner-observation derives from documented resources seen in logs with [[CrashCapture]] or [[Heimdallr]]; heuristic matches alone are not proof of NSO attribution.