Loading malware…
Candiru is a mercenary spyware platform associated with the Israeli surveillance vendor commonly referred to as Candiru. It has been used to target journalists, activists, politicians, civil society members, and other high-value individuals, including members of the Catalan independence movement and European political figures. Public reporting has linked deployments of Candiru spyware to multiple countries, and investigations have identified its use in politically sensitive surveillance operations.
Candiru is known for intrusive post-compromise surveillance capabilities typical of advanced commercial spyware. Documented behavior includes covert compromise of victim devices, persistent access, and collection or exfiltration of sensitive information. Research into Candiru operations has also tied the platform to exploitation of Microsoft Windows vulnerabilities and to tailored customer infrastructure used in targeted campaigns. In Catalan-targeting operations, Candiru activity included email-based lures impersonating trusted institutions, indicating a spearphishing delivery model in at least some cases.
The spyware has been observed alongside other mercenary surveillance tools such as Pegasus and Predator in campaigns against civil society and political targets. Investigations have identified Candiru victims or attempted targeting in Europe and elsewhere, including cases involving Members of the European Parliament. Reporting from 2024 to 2026 further indicated deployment of Candiru or related Candiru infrastructure by numerous state customers against journalists and civil society members.
Candiru is best understood as a commercial espionage spyware capability sold to government customers for covert surveillance. Its known use cases center on intelligence collection and monitoring of selected individuals rather than broad criminal monetization.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Microsoft also discovered two zero-day vulnerabilities (CVE-2021-31979, CVE-2021-33771) employed by Candiru to infect Windows systems, and patched them in July 2021. | Finding: Catalans Targeted with Candiru. In July 2021, we published “Hooking Candiru,” in which we identified and analysed Candiru’s mercenary spyware, in cooperation with Microsoft.
Microsoft also discovered two zero-day vulnerabilities (CVE-2021-31979, CVE-2021-33771) employed by Candiru to infect Windows systems, and patched them in July 2021. | Finding: Catalans Targeted with Candiru. In July 2021, we published “Hooking Candiru,” in which we identified and analysed Candiru’s mercenary spyware, in cooperation with Microsoft.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Finding: Catalans Targeted with Candiru. In July 2021, we published “Hooking Candiru,” in which we identified and analysed Candiru’s mercenary spyware, in cooperation with Microsoft.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
As commercial spyware relies on zero-day exploits for deployment, Insikt Group previously assessed that, in addition to posing serious human rights concerns, its misuse threatens the broader cyber ecosystem by enabling the proliferation of critical vulnerabilities.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Spyware strain mentioned in connection with infections targeting people associated with the Catalan separatist movement in Spain.
Mercenary spyware referenced as another spyware platform used against European lawmakers.
Commercial spyware deployed by governments against journalists and civil society members.
Commercial spyware vendor/tooling referenced as deployed by governments for surveillance operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.