[Leparamour]

Possible. But they rely on the infrastructure AWS, Linode or DigitalOcean provide in order to fly under the radar among legitimate traffic. If all of these service providers were to blacklist NSO, Candiru or Cellebrite those would have to fall back to more exotic providers and would therefore be easier to uncover.