Threat Actor: Candiru / Saito Tech Ltd
Candiru / Saito Tech Ltd is classified as an advanced Commercial Cyber-Surveillance Contractor originating primarily from Israel (Tel Aviv). Driven by operational objectives spanning commercial zero-day surveillance, diplomatic espionage & target infiltration, this threat entity has maintained an active footprint from 2014 - Present. In enterprise telemetry and malware repository classification, Candiru / Saito Tech Ltd has been corroborated across 1 distinct malware families with over 45 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | Saito Tech, Taveta Ltd, Grindavik Solutions, DevilsTongue Operator |
|---|---|
| Targeted Sectors | Investigative Journalists, Human Rights Defenders, Civil Society NGOs, Political Opposition, Diplomatic Personnel |
| Primary Motivations | Commercial Zero-Day Surveillance, Diplomatic Espionage & Target Infiltration |
| Dominant Payload Categories | Spyware |
| MITRE ATT&CK Reference | https://attack.mitre.org/groups/G0135/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Candiru / Saito Tech Ltd:
T1203— weaponized across 1 catalog payload(s)T1068— weaponized across 1 catalog payload(s)T1055— weaponized across 1 catalog payload(s)T1056.001— weaponized across 1 catalog payload(s)T1113— weaponized across 1 catalog payload(s)T1123— weaponized across 1 catalog payload(s)T1555.003— weaponized across 1 catalog payload(s)T1539— weaponized across 1 catalog payload(s)T1005— weaponized across 1 catalog payload(s)T1071.001— weaponized across 1 catalog payload(s)T1003.001— weaponized across 1 catalog payload(s)T1027— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Candiru / Saito Tech Ltd has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2021-21166 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2021-30551 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2021-31979 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2021-33771 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2022-2294 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (1 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Candiru / Saito Tech Ltd:
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding Candiru / Saito Tech Ltd operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Candiru / Saito Tech Ltd requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).