Microsoft and Citizen Lab say government hackers from several countries have used spyware from Israeli vendor Candiru that uses two 0-day exploits in Windows
Microsoft and Citizen Lab found a new kind of spyware made by the mysterious Israeli vendor Candiru, and targeting someone in Europe based on their political beliefs.
Government hacking customers using Candiru gain an intrusion route built on two previously unknown Windows vulnerabilities, while the politically targeted European victim faces covert surveillance exposure.
Candiru is publicly associated with Windows zero-day use against a politically selected target, increasing scrutiny of the vendor and its government customers.
Second-order effects
Microsoft and Citizen Lab’s disclosure gives defenders and investigators a named vendor and exploit pattern to track, rather than an unidentified intrusion campaign.
Candiru’s documented Windows activity adds pressure to a commercial-spyware sector already associated with NSO Group and later reports of QuaDream targeting iPhones.
Third-order effects
The linked cases point to a durable market structure in which multiple specialist vendors supply government-facing spyware across operating systems, complicating efforts to address the problem vendor by vendor.
Public technical attribution is becoming a central constraint on mercenary spyware: it exposes both exploit use and the political targeting patterns of state customers, even as new vendors emerge.
The trend: Commercial spyware is evolving into a multi-vendor, cross-platform market whose operations are increasingly exposed through joint research by platform companies and civil-society labs.
🚨MAJOR REPORT in collaboration with @MsftSecIntel exposing spyware company Candiru. Websites serving their spyware include fake #BlackLivesMatter & fake human rights groups. Targets: journalists, human rights defenders, around world. THREAD Report: https://citizenlab.ca/... https…
@shanehuntley
Shane Huntley on x
Excellent report by Citizen Lab today where they tie the vendor zero-day exploitation we published on yesterday to Candiru. https://twitter.com/... https://twitter.com/...
@rondeibert
Profdeibert on x
Candiru's registration of domains impersonating “Black Lives Matters,” human rights orgs, news, gender studies shows it is specifically tailoring its services to gov clients who are then targeting global civil society. This is “Abuse-As-A-Service” https://citizenlab.ca/... https:…
@runasand
Runa Sandvik on x
In which @citizenlab continues to show that a small academic research lab can do impactful and meaningful work, even teaming up with a tech giant like @Microsoft. https://twitter.com/...
@benjaminbland
Ben Bland on x
Rise of invasive digital surveillance often painted as a Chinese innovation. But companies from many other nations are selling these tools to govts w/ repressive tendencies. @citizenlab reports on Israeli group w/ spyware active in UAE, Hungary & Indonesia https://citizenlab.ca/.…
@scottmstedman
Scott Stedman on x
NSO Group-linked company Candiru found operating in Russia even though their terms say they don't operate there. https://twitter.com/... https://twitter.com/...
@tvietor08
Tommy Vietor on x
I hope the Biden admin will pressure the Israeli government to shut these companies down. https://www.washingtonpost.com/ ...
@thedeshbhakt
@thedeshbhakt on x
Apparently the use of high end Spyware to track people with different political beliefs is not that rare and its happening at lot more. THIS is digital dystopia.... https://www.vice.com/... https://twitter.com/... https://twitter.com/...
@robertmlee
Robert M. Lee on x
I've said it before but I've never once judged foreign intelligence agencies doing espionage. I try to stop them. My team your team. I get it. But hacker for hire groups...targeting of journalists and dissidents...my words here would be too coarse. I'd hope they all rot. https://…
@jsrailton
John Scott-Railton on x
2. We @citizenlab identified a Candiru-infected, politically active individual in Western Europe. We extracted the infection & worked with @MsftSecIntel who found two Windows 0-day exploits CVE-2021-31979 and CVE-2021-33771. @Microsoft has now patched. https://www.microsoft.com/.…
@samtlevin
Sam Levin on x
NEW: An Israeli company's spyware uses fake Black Lives Matter and Amnesty International websites to hack targets, according to @citizenlab Candiru sells its tech to governments + has been linked to websites impersonating nonprofits + activist groups: https://www.theguardian.com/…
@ericgarland
Eric Garland on x
The Israeli government should explain the actions of Black Cube, NSO, Psy Group, this one - Candiru/Saito Tech/Taveta, as well as any other companies helping dictatorships and Mobsters engage in hostile intel operations. https://blogs.microsoft.com/ ...
@johnlatwc
John Lambert on x
It's not often we create a new namespace to track actors. We only do that if the area is dynamic, durable, and impacting customers. We did that for this area of private sector offensive actors. WHY: https://blogs.microsoft.com/ ... WHAT: https://www.microsoft.com/...
@jsrailton
John Scott-Railton on x
6. See this? For a long time private sector offensive actors (PSOAs) like Candiru, #NSOGroup & others ran below the radar of big tech. No longer. Big tech is fed up with the damage PSOAs cause, and is now hitting back. Hard. By @CristinGoodwin https://blogs.microsoft.com/ ... htt…
@carlwoog
Carl Woog on x
Tremendous work by @citizenlab and @MSFTIssues finding and stopping a serious spyware attack. https://blogs.microsoft.com/ ...
@rondeibert
Profdeibert on x
In order to remedy the harms generated by mercenary spyware, cooperation among academic researchers, network defenders, threat intelligence teams, and technology platforms is critical. Glad to work with @MsftSecIntel @teamcymru & others to get this out https://blogs.microsoft.com…
@cristingoodwin
Cristin Goodwin on x
Terrific report from @citizenlab detailing the work of this private sector offensive actor we call SOURGUM, also known as Candiru. With over 100 victims in 10 countries, important to take this step. https://twitter.com/...
@jsrailton
John Scott-Railton on x
@Google @_clem1 @maddiestone 5. The problem with the “government exclusive” hacking industry isn't individual companies... The issue is that, to grow, any company in the sector will inevitably sell to authoritarians..who will do authoritarian things. Story: @Joseph_Marks_ https:/…
@ericgarland
Eric Garland on x
“At least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, UK, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.” The government of Israel should explain this. https://citizenlab.ca/...
@selenalarson
Selena on x
Incredible work here, and I appreciate the detailing of all the hunting and pivots that went into it https://citizenlab.ca/...
@raffiwriter
Raffi Khatchadourian on x
“The company known as ‘Candiru,’ based in Tel Aviv, Israel, is a mercenary spyware firm that markets ‘untraceable’ spyware to government customers. Their product offering includes solutions for spying on computers, mobile devices, and cloud accounts.” https://twitter.com/...
@w7voa
Steve Herman on x
A group in #Israel allegedly sold tools to hack @Windows. https://twitter.com/...
@maddiestone
Maddie Stone on x
Citizen Lab ties Israeli surveillance vendor, Candiru, to 3 of the 0-day exploits we published about yesterday, and two Windows priv escs that Microsoft patched on Tuesday. https://twitter.com/...
@josephfcox
Joseph Cox on x
New: Windows exploits from secretive Israeli spyware firm Candiru found in the wild. Were targeting hundreds of victims including “politicians, human rights activists, journalists, academics, embassy workers, and political dissidents” https://www.vice.com/...
@lorenzofb
Lorenzo Franceschi-Bicchierai on x
NEW: Citizen Lab and Microsoft have caught government hackers using spyware made by the mysterious Israeli vendor Candiru. -More than 100 victims in Palestine, Israel, Iran, Spain, UK etc. -CL says it has found Candiru systems in UAE and Saudi Arabia. https://www.vice.com/...