Loading story…
Citizen Lab and Microsoft exposed Candiru, an Israel-based mercenary spyware vendor also known as Saito Tech Ltd., after investigators recovered a Windows malware sample dubbed DevilsTongue from a politically active victim in Western Europe. The investigation tied Candiru to a large surveillance operation that used more than 750 spoofed domains masquerading as media outlets, advocacy groups, international organizations, and technology brands to lure targets and support spyware delivery.
Microsoft said the operation exploited two Windows privilege-escalation zero-days, CVE-2021-31979 and CVE-2021-33771, which it patched as part of its response. Researchers and Microsoft linked the activity to at least 100 victims across countries including Palestine, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia, and Singapore, with journalists, dissidents, activists, politicians, and human rights defenders among those targeted; the infrastructure was also connected to the CHAINSHOT exploit kit and earlier Chrome and Microsoft Office zero-day exploitation.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published details on a private-sector offensive actor using 0-day exploits and DevilsTongue malware. Citizen Lab says Microsoft observed at least 100 victims across countries including Palestine, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia, and Singapore, including journalists, dissidents, activists, politicians, academics, and embassy workers.
Google Threat Analysis Group reported Chrome zero-days CVE-2021-21166 and CVE-2021-30551, and Citizen Lab says eight of the nine exploit distribution websites in that report matched Candiru's CF3 infrastructure fingerprint. Citizen Lab also notes Google linked Microsoft Office exploit CVE-2021-33742 to the same operator.
Microsoft patched CVE-2021-31979 and CVE-2021-33771, two Windows privilege escalation vulnerabilities that Citizen Lab says were discovered during joint analysis of Candiru spyware with Microsoft Threat Intelligence Center.
Citizen Lab says Candiru, an Israel-based spyware company also known as Saito Tech Ltd., was founded in Tel Aviv in 2014.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 83 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourceblogs.microsoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Human rights defenders in India were targeted in a coordinated spearphishing operation that used impersonation lures and links hosted on Firefox Send to deliver **NetWire** spyware to Windows systems. Amnesty International and Citizen Lab said at least nine activists, lawyers, academics, and a journalist connected to advocacy or legal work around the **Bhima Koregaon 11** were targeted between January and October 2019, in what researchers assessed was an unlawful surveillance effort rather than ordinary cybercrime. Technical analysis tied the activity to NetWire payloads communicating with `researchplanet.zapto[.]org` over port `1810`, and the report noted that some of the same individuals had also previously been targeted with **Pegasus** spyware. A separate but related campaign described by Cisco Talos showed continued use of **NetWireRAT** in targeted attacks across the Indian subcontinent, this time aimed at Indian government employees and military personnel. Active since late 2020, the operation used malicious Office documents, archives, compromised websites, and fake domains, with lures themed around Indian government matters such as the **Kavach** two-factor authentication application; operators also deployed **WarzoneRAT**, persistence mechanisms, process hollowing, and custom file-enumerator malware. Talos said the tactics and lures resembled activity linked to **Transparent Tribe** and **SideCopy**, highlighting sustained use of commercial remote-access malware in espionage-focused campaigns against Indian civil society and state-linked targets.
Aug 14, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026
Attackers ran a multi-stage information-stealing campaign against victims in Latin America and Asia Pacific by distributing password-protected archives disguised as pirated software. Trellix reported that the infection chain abused legitimate **Cisco Webex** binaries for **DLL sideloading**, which launched **HijackLoader** and then **Vidar Stealer** through an **AutoIt3** component, enabling theft of browser credentials and communication with command-and-control infrastructure. The campaign used several defense-evasion and post-compromise techniques, including a **COM-based UAC bypass**, adding **Windows Defender** exclusions, and injecting into **`MSBuild.exe`**. Trellix said the malware also fetched additional payloads and ultimately launched a cryptominer via **`AddInProcess.exe`**, describing the operation as a fresh and evasive threat with low detections in threat feeds despite clear execution-chain visibility in EDR telemetry.
Aug 14, 2026