Candid Candiru: Report dredges up details on secretive spyware company

guest · Jan 4, 2019

Candid Candiru: Report dredges up details on secretive spyware company
January 4, 2019
https://www.scmagazine.com/home/sec...dges-up-details-on-secretive-spyware-company/

A report from Israeli news outlet Haaretz has ever so slightly lifted the veil on what may be Israel’s second largest commercial provider of offensive cyber tools and spyware, a clandestine company called Candiru.

Reportedly, Candiru’s specialty is software that allows offensive users to break into their targets’ computers and servers, although sources say it likely sells tools designed for mobile devices as well.

Haaretz reports that Candiru was created by Isaac Zack,who also founded NSO Group, Israel’s top commercial provider of cyber offensive tools. But while NSO has stirred up controversy for allegedly selling to governments that use cyber tools to spy on dissidents and activists, Candiru reportedly is more selective about its client base, largely doing business with Western European nations.
Click to expand...

guest · Oct 3, 2019

Meet Candiru — The Mysterious Mercenaries Hacking Apple And Microsoft PCs For Profit
October 3, 2019
https://www.forbes.com/sites/thomas...le-and-microsoft-pcs-for-profit/#21d066565a39

Israel is home to scores of hacker-for-hire businesses, but one of the most clandestine has been Candiru. With no website and few records available, it’s operated largely under the radar.

But now a researcher is claiming the elite Tel Aviv-based firm sold cyber weapons to the government of Uzbekistan, while industry sources tell Forbes the company is hacking both Microsoft Windows and Apple Macs for various nation states.
Human rights experts have now raised the alarm about Candiru’s customer base and the potential for abuse. Bartholomew and another source with knowledge of the attacks said he discovered Candiru surveillance software was used in previously reported hacks on Uzbek human rights activists and independent media.

“Each of these governments is a serial spyware abuser, and it is painfully predictable that civil society got targeted again,” said John Scott-Railton, a surveillance market researcher at the University of Toronto’s Citizen Lab.
Outside of Candiru’s apparent relationship with Dilian’s spyware enterprises—WiSpear and Intellexa—it has at least one tie to the most controversial of Israel’s surveillance providers: NSO Group.
Click to expand...

guest · Jul 15, 2021

Mysterious Israeli Spyware Vendor’s Windows Zero-Days Caught in the Wild
Microsoft and Citizen Lab found a new kind of spyware made by the mysterious Israeli vendor Candiru
July 15, 2021
https://www.vice.com/en/article/bvz...ndiru-zero-day-exploits-microsoft-citizen-lab

Government hackers from several countries used spyware made by an Israeli company to target victims all over the world, according to new research by digital rights watchdog Citizen Lab and Microsoft. The spyware leveraged two unknown vulnerabilities—also known as zero-day exploits—in Windows.

The company said it detected hacking attempts on more than 100 victims including "politicians, human rights activists, journalists, academics, embassy workers, and political dissidents" in Palestine, Israel, Iran, Lebanon, Spain, UK, and other countries. Citizen Lab said it was able to identify and reach out to a victim who let its researchers analyze their computer and extract the malware.

“This was someone who was targeted for their political positions and political beliefs, rather than someone who was the target of a terrorism investigation or something like this,” Bill Marczak, one of the researchers at Citizen Lab who worked on the investigations, told Motherboard in a phone call.
These discoveries highlight once more the dangers of a loosely regulated global market for government spyware.
Click to expand...

Citizen Lab: Hooking Candiru - Another Mercenary Spyware Vendor Comes into Focus

Summary

Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Reportedly, their spyware can infect and monitor iPhones, Androids, Macs, PCs, and cloud accounts.

Using Internet scanning we identified more than 750 websites linked to Candiru’s spyware infrastructure. We found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter movement, as well as media companies, and other civil-society themed entities.

We identified a politically active victim in Western Europe and recovered a copy of Candiru’s Windows spyware.

Working with Microsoft Threat Intelligence Center (MSTIC) we analyzed the spyware, resulting in the discovery of CVE-2021-31979 and CVE-2021-33771 by Microsoft, two privilege escalation vulnerabilities exploited by Candiru. Microsoft patched both vulnerabilities on July 13th, 2021.

Click to expand...

As part of their investigation, Microsoft observed at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.

We provide a brief technical overview of the Candiru spyware’s persistence mechanism and some details about the spyware’s functionality.

Candiru has made efforts to obscure its ownership structure, staffing, and investment partners. Nevertheless, we have been able to shed some light on those areas in this report.

Click to expand...

guest · Jul 16, 2021

Microsoft disrupts products from Israeli tech firm used to hack journalists, activists
July 15, 2021
https://thehill.com/policy/technolo...om-israeli-tech-firm-used-to-hack-journalists

Microsoft on Thursday announced that it had disrupted the use of what it described as “cyberweapons” manufactured and sold by an Israeli-based company to target victims worldwide including journalists and human rights activists.

The group, known as “Sourgum,” is what Microsoft described as a “private sector offensive actor,” and was known to sell weapons to government agencies around the world that were then used to hack into the personal devices of targeted individuals, including phones, computers, and other internet-connected devices.

“These agencies then choose who to target and run the actual operations themselves,” Cristin Goodwin, general manager of Microsoft’s Digital Security Unit, wrote in a blog post published Thursday.
The discovery of the use of Sourgum products to target victims was due to a tip given to Microsoft by Citizen Lab about the malware used by the group.
Click to expand...

Citizen Lab researchers labeled the group as “Candiru” instead of Sourgum, and wrote in the report that it was based in Tel Aviv and was “a mercenary spyware firm that markets ‘untraceable’ spyware to government customers.”

Goodwin stressed that Microsoft would continue its work against these types of companies.

“A world where private sector companies manufacture and sell cyberweapons is more dangerous for consumers, businesses of all sizes and governments,” Goodwin wrote.
Click to expand...

Microsoft points the finger at Israeli spyware seller for DevilsTongue attacks
https://www.zdnet.com/article/micro...loit-seller-for-devilstongue-malware-attacks/

A tip provided by human rights outfit Citizen Lab led Microsoft to the PSOA, dubbed Sourgum, a company said to sell cyberweapons including the DevilsTongue malware.

Approximately half of DevilsTongue victims are located in Palestine, but a handful has also been traced back to countries including Israel, Iran, Spain/Catalonia, and the United Kingdom.
Click to expand...

Microsoft says that the exploits are "key" elements of wider attack chains used by Sourgum to target Windows PCs and browsers in order to deliver DevilsTongue. Browser exploits appear to be used in one of the initial attack stages, where they are served through malicious URLs and sent via messaging services including WhatsApp.
Click to expand...

guest · Nov 17, 2021

Israel's Candiru Spyware Found Linked to Watering Hole Attacks in U.K and Middle East
November 17, 2021
https://thehackernews.com/2021/11/israels-candiru-spyware-found-linked-to.html

Israeli spyware vendor Candiru, which was added to an economic blocklist by the U.S. government this month, is said to have reportedly waged "watering hole" attacks against high-profile entities in the U.K. and the Middle East, new findings reveal.

"The victimized websites belong to media outlets in the U.K., Yemen, and Saudi Arabia, as well as to Hezbollah; to government institutions in Iran (Ministry of Foreign Affairs), Syria (including the Ministry of Electricity), and Yemen (including the Ministries of Interior and Finance); to internet service providers in Yemen and Syria; and to aerospace/military technology companies in Italy and South Africa," ESET said in a new report. "The attackers also created a website mimicking a medical trade fair in Germany."
"The compromised websites are only used as a jumping-off point to reach the final targets," the Slovak cybersecurity firm said, linking the second wave to a threat actor tracked by Kaspersky as Karkadann citing overlaps in the tactics, techniques, and procedures (TTPs).
Click to expand...

The original attack chains involved injecting JavaScript code into the websites from a remote attacker-controlled domain that's designed to collect and exfiltrated I.P. geolocation and system information about the victim machine, opting to proceed further only if the operating system in question is either Windows or macOS, suggesting the campaign was orchestrated to target computers and not mobile devices.

The final step led to a likely browser remote code execution exploit that enabled the attackers to hijack control of the machines.
Click to expand...

ESET: Strategic web compromises in the Middle East with a pinch of Candiru

Conclusion
This report describes two strategic web compromise campaigns targeting high-profile organizations in the Middle East, with a strong focus on Yemen. We also revealed links to Candiru, a spyware firm, that sells state‑of‑the‑art offensive software tools and related services to government agencies.

We were unable to get an exploit and the final payload. This shows that the operators choose to narrow the focus of their operations and that they don’t want to burn their zero-day exploits.
Click to expand...

We stopped seeing activity from this operation at the end of July 2021, shortly after the release of blogposts by the Citizen Lab, Google and Microsoft detailing the activities of Candiru.

A comprehensive list of Indicators of Compromise (IoCs) and samples can be found in our GitHub repository.
Click to expand...

guest · Jul 21, 2022

Spyware maker Candiru linked to Chrome zero-day targeting journalists
July 21, 2022

Security researchers have linked the discovery of an actively exploited but since-fixed zero-day vulnerability in Google Chrome to an Israeli spyware maker targeting journalists in the Middle East.

Cybersecurity company Avast has linked the exploitation to Candiru, a Tel Aviv-based hacking-for-hire company also known as Saito Tech, which provides its powerful spyware to government clients. Candiru, much like Israel’s NSO Group, claims its software is designed to be used by government and law enforcement agencies to thwart potential terrorism and crime, but researchers have found that authoritarian regimes have used the spyware to target journalists, political dissidents and critics of repressive regimes. Candiru was sanctioned by the U.S. Commerce Department for engaging in activities contrary to U.S. national security.
Click to expand...

Avast said it observed Candiru in March using the Chrome zero-day exploit for targeting individuals in Turkey, Yemen and Palestine — as well as journalists in Lebanon, where Candiru compromised a website used by employees of a news agency.

“We can’t say for sure what the attackers might have been after, however often the reason why attackers go after journalists is to spy on them and the stories they’re working on directly, or to get to their sources and gather compromising information and sensitive data they shared with the press,” said Jan Vojtěšek, malware researcher at Avast. “An attack like this could pose a threat to press freedom.”
Click to expand...

Avast: The Return of Candiru: Zero-days in the Middle East

We recently discovered a zero-day vulnerability in Google Chrome (CVE-2022-2294) when it was exploited in the wild in an attempt to attack Avast users in the Middle East. Specifically, a large portion of the attacks took place in Lebanon, where journalists were among the targeted parties.

The vulnerability was a memory corruption in WebRTC that was abused to achieve shellcode execution in Chrome’s renderer process. We reported this vulnerability to Google, who patched it on July 4, 2022.
Click to expand...

Based on the malware and TTPs used to carry out the attack, we can confidently attribute it to a secretive spyware vendor of many names, most commonly known as Candiru. (A name the threat actors chose themselves, inspired by a horrifying parasitic fish of the same name.)
Click to expand...

Log in or Sign up

Candid Candiru: Report dredges up details on secretive spyware company

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Candid Candiru: Report dredges up details on secretive spyware company

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches