{ "family": "candiru", "sample_count": 45, "category": "spyware", "description": "Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor specializing in advanced zero-day mercenary spyware targeting Microsoft Windows, with modular extensions for macOS, iOS, and Android. Documented and forensically analyzed in July 2021 by The Citizen Lab and Microsoft Threat Intelligence Center (MSTIC), Candiru's primary espionage implant—tracked by Microsoft as 'DevilsTongue' and internally codenamed 'Caramel' or 'Sherlock'—is weaponized by government customers to execute covert surveillance against high-profile journalists, human rights activists, legal counsel, and political opposition figures across Europe, the Middle East, and Latin America. Candiru specializes in zero-click and precision one-click exploit chains: on Windows endpoints, it weaponized browser remote code execution zero-days (such as the Google Chrome WebRTC flaw CVE-2022-2294 discovered by Avast) chained with twin Windows GDI/win32k kernel privilege escalation zero-days (CVE-2021-31979 and CVE-2021-33771) to escape sandboxes and establish SYSTEM-level execution. Once deployed, DevilsTongue acts as an invasive multi-modular surveillance framework: it hooks process memory to extract end-to-end encrypted chat logs (Signal, WhatsApp, Telegram, Skype), harvests saved browser passwords and active session cookies to bypass Multi-Factor Authentication (MFA), exfiltrates Outlook message spools, captures microphone audio and keystrokes, and executes LSASS memory dumping to harvest Kerberos and NTLM credentials for network lateral movement.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Candiru Spyware", "DevilsTongue", "Saito Tech", "KANDIRU", "Caramel Spyware", "Taveta", "Grindavik Solutions", "Sherlock (Internal Code)" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Candiru and what is the DevilsTongue spyware?", "acceptedAnswer": { "@type": "Answer", "text": "Candiru (also known as Saito Tech Ltd) is an Israeli commercial surveillance vendor that manufactures and licenses state-grade offensive intrusion tools to government intelligence and law enforcement agencies. DevilsTongue is Candiru's flagship multi-modular espionage implant, engineered to covertly compromise Windows, macOS, iOS, and Android devices to conduct comprehensive remote surveillance." } }, { "@type": "Question", "name": "How does Candiru achieve zero-click and one-click initial access?", "acceptedAnswer": { "@type": "Answer", "text": "Candiru deploys sophisticated watering hole attacks, spear-phishing messages, and malicious redirect meshes. In multiple documented campaigns, Candiru weaponized zero-day remote code execution vulnerabilities in web browsers (such as Google Chrome WebRTC flaw CVE-2022-2294) to execute arbitrary code within the browser sandbox without requiring file downloads." } }, { "@type": "Question", "name": "What Windows kernel zero-days were weaponized by Candiru (CVE-2021-31979 & CVE-2021-33771)?", "acceptedAnswer": { "@type": "Answer", "text": "To escape browser sandboxes and escalate to NT AUTHORITY\\SYSTEM privileges, Candiru weaponized twin zero-day vulnerabilities in the Windows GDI (Graphics Device Interface) / win32k.sys kernel subsystem (CVE-2021-31979 and CVE-2021-33771). These vulnerabilities allowed DevilsTongue to perform out-of-bounds kernel memory read/write operations, disabling security hooks and deploying kernel drivers without triggering Driver Signature Enforcement." } }, { "@type": "Question", "name": "How does DevilsTongue intercept end-to-end encrypted chats on Signal, WhatsApp, and Telegram?", "acceptedAnswer": { "@type": "Answer", "text": "Rather than attempting to break cryptographic algorithms in transit, DevilsTongue operates directly in host memory and local application storage. Running with SYSTEM privileges, it injects into running browser and desktop messaging processes, hooking into SQLite databases, local session caches, and keystroke buffers to intercept plaintext messages, voice notes, and contact lists directly before encryption or after decryption." } }, { "@type": "Question", "name": "How does Candiru hijack web sessions and bypass Multi-Factor Authentication (MFA)?", "acceptedAnswer": { "@type": "Answer", "text": "DevilsTongue extracts stored browser credentials and active session cookies from Chrome, Edge, and Firefox profiles (MITRE T1539 and T1555.003). By exfiltrating active session tokens for services like Google Workspace, Microsoft 365, and social networks, attackers import the tokens into external browsers and authenticate as the victim without triggering two-factor authentication prompts." } }, { "@type": "Question", "name": "What is the significance of the Google Chrome zero-day CVE-2022-2294?", "acceptedAnswer": { "@type": "Answer", "text": "Discovered in the wild by Avast threat researchers in 2022, CVE-2022-2294 was a heap buffer overflow vulnerability in WebRTC (Web Real-Time Communication) leveraged by Candiru to target journalists and dissidents in the Middle East. It allowed attackers to execute shellcode simply by loading a compromised or malicious web page in Chromium-based browsers." } }, { "@type": "Question", "name": "What forensic indicators and detection strategies expose Candiru infections?", "acceptedAnswer": { "@type": "Answer", "text": "Microsoft MSTIC and Citizen Lab identified distinctive behavioral markers, including unbacked executable memory in svchost.exe and lsass.exe, anomalous win32k GDI allocations, and outbound encrypted C2 traffic directed to domains masquerading as legitimate advocacy or media organizations (e.g., spoofing Amnesty International, Black Lives Matter, or WHO). Endpoint defense requires kernel-level process monitoring, LSASS credential protection (RunAsPPL / Credential Guard), and aggressive browser attack surface reduction." } } ], "faq_count": 7, "mitre_attack": [ "T1203", "T1068", "T1055", "T1056.001", "T1113", "T1123", "T1555.003", "T1539", "T1005", "T1071.001", "T1003.001", "T1027" ], "mitre_attack_detail": [ { "id": "T1203", "name": "Exploitation for Client Execution", "tactic": "execution" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "tactic": "privilege-escalation" }, { "id": "T1055", "name": "Process Injection", "tactic": "defense-evasion" }, { "id": "T1056.001", "name": "Keylogging", "tactic": "credential-access" }, { "id": "T1113", "name": "Screen Capture", "tactic": "collection" }, { "id": "T1123", "name": "Audio Capture", "tactic": "collection" }, { "id": "T1555.003", "name": "Credentials from Web Browsers", "tactic": "credential-access" }, { "id": "T1539", "name": "Steal Web Session Cookie", "tactic": "credential-access" }, { "id": "T1005", "name": "Data from Local System", "tactic": "collection" }, { "id": "T1071.001", "name": "Web Protocols", "tactic": "command-and-control" }, { "id": "T1003.001", "name": "LSASS Memory", "tactic": "credential-access" }, { "id": "T1027", "name": "Obfuscated Files or Information", "tactic": "defense-evasion" } ], "cisa_advisory": "CISA Known Exploited Vulnerabilities (KEV) Catalog: CVE-2021-31979, CVE-2021-33771, CVE-2022-2294", "last_updated": "2026-10-16", "first_seen": 2014, "lineage": { "derived_from": [ "candiru surveillance framework" ], "variants": [ "devilstongue_windows", "caramel_loader", "candiru_ios", "candiru_android" ] }, "attribution": [ { "actor": "Candiru / Saito Tech Ltd", "confidence": "high" } ], "exploited_cves": [ "CVE-2021-31979", "CVE-2021-33771", "CVE-2022-2294", "CVE-2021-21166", "CVE-2021-30551" ], "c2_profile": { "protocols": [ "HTTPS", "TLS" ], "ports": [ 443 ], "traffic_identifiability": "low" }, "iocs": { "file_hashes": [ "4e311f59223755ba9e74403cd3b036fa7c617a2fbcfcbb2e0f2f35fe99f927b2", "92e10db56306e00b3e83b8b1784fbe3efaa447a123f1e917d23d9b0151a66e4a", "a3b1eb887f43398be3bfbb43952baab464010a30bfeee37c68ba02a6ce2bbffb" ], "delivery": [ "Zero-click Chrome WebRTC heap buffer overflow exploitation (CVE-2022-2294)", "Watering-hole URL redirection targeting regional news, diplomacy, and civil society sites", "Spear-phishing delivery leveraging shortened URLs mimicking media and NGO domains" ], "persistence": [ "Process injection into critical Windows daemons (svchost.exe, lsass.exe)", "Exploitation of Windows GDI kernel drivers (CVE-2021-31979, CVE-2021-33771) for ring-0 elevation", "Execution of custom signed/unsigned kernel drivers with anti-forensic log tampering" ] }, "sources": [ { "name": "The Citizen Lab: Hooking Candiru - Another Mercenary Spyware Vendor Comes into the Light", "url": "https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-the-light/" }, { "name": "Microsoft MSTIC: Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" }, { "name": "Avast Threat Intelligence: The Return of Candiru - Zero-day in Google Chrome Used to Target Journalists", "url": "https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-day-in-google-chrome-used-to-target-journalists/" }, { "name": "CISA Known Exploited Vulnerabilities Catalog: CVE-2021-31979, CVE-2021-33771, CVE-2022-2294", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "containment_steps": [ "Sever all network connectivity immediately (disconnect physical Ethernet and disable all wireless/cellular interfaces) to prevent real-time C2 exfiltration.", "Perform immediate volatile memory capture using specialized forensic hardware or live triaging kits before powering down or rebooting.", "Enforce enterprise-wide session revocation: invalidate all OAuth tokens, active session cookies, and Kerberos tickets, and initiate full credential resets from a known-secure terminal.", "Conduct bare-metal reimaging and firmware verification on all suspected endpoints, as DevilsTongue installs deep kernel hooks that evade standard operating system uninstallation." ], "what_to_avoid": [ "Do not trust standard user-mode antivirus or endpoint scans to confirm eradication, as DevilsTongue hooks kernel memory structures and actively masks its footprint.", "Avoid accessing corporate cloud repositories, webmail, or encrypted chat sessions on a suspect host until forensic validation is complete.", "Do not assume that restarting the system neutralizes the threat, as kernel driver hooks and persistent scheduled tasks survive reboot cycles." ], "target_industries": [ "journalism", "human_rights", "civil_society", "government", "legal", "diplomatic" ], "motivation": "Commercial Cyber Espionage & Covert Surveillance", "threat_actors": [ "Candiru", "Saito Tech Ltd", "Taveta" ], "target_geographies": [ "ES", "LB", "PS", "IL", "SA", "AE", "HU", "TR", "GLOBAL" ], "attack_stage": [ "initial-access", "execution", "privilege-escalation", "defense-evasion", "credential-access", "collection", "command-and-control", "exfiltration" ], "ecosystem": [ "windows", "macos", "ios", "android" ], "is_emerging": false, "target_platforms": [ "Windows 11", "Windows 10", "Windows Server", "macOS", "iOS", "Android" ] }