Candiru Spyware: Inside the Mercenary Operator Powering AdFection and DevilsTongue

Who is Candiru?

Candiru is an Israeli mercenary surveillance company that develops and sells offensive spyware primarily targeting Windows systems, with reported mobile capabilities. Microsoft first publicly documented the company's Windows implant, called DevilsTongue, in July 2021, referring to Candiru under the actor name SOURGUM. The company has been linked to a series of zero-day exploits against Microsoft Windows and Google Chrome, and its tools have been used against journalists, activists, government officials, and embassy personnel.

In November 2021, the U.S. Department of Commerce added Candiru, operating under the name Saito Tech, to the Entity List for supplying spyware that governments used to target officials, journalists, activists, academics, businesspeople, and embassy personnel. This designation restricts the company's access to U.S. technology and exports.

Citizen Lab's October 2026 AdFection report identified Candiru as the spyware operator whose infrastructure was delivered through Discover-Tech's advertising pipeline. Recorded Future's 2025 research separately identified an Israeli company called Integrity Labs Ltd, incorporated in December 2024, during investigation of Candiru-linked DevilsTongue infrastructure, suggesting Candiru underwent a corporate rebranding.

Candiru's offensive capability set

Candiru's primary Windows implant, DevilsTongue, is a sophisticated modular C and C++ surveillance framework with both user-mode and kernel-mode capabilities. Microsoft's 2021 analysis documented the implant's ability to collect files, browser cookies, browsing history, saved credentials, and authentication tokens. It has also been associated with accessing communications and credentials for services including email, social media, and Signal Desktop.

The offensive toolkit includes significant anti-analysis features. Microsoft found encrypted configurations, encrypted payloads, in-memory execution, unique hashes, scrubbed PE metadata, and multiple detection-evasion mechanisms. These features make the implant difficult to analyze and detect through traditional signature-based methods.

From an offensive perspective, Candiru's value proposition is the combination of zero-click delivery, persistent surveillance, and operational stealth. The company has repeatedly demonstrated access to expensive browser and Windows exploit chains, which are necessary for the final compromise stage of attacks like AdFection.

Candiru's documented exploit history

Candiru has been linked to a series of publicly disclosed vulnerabilities that demonstrate the company's investment in high-value exploit chains. These include CVE-2021-31979 and CVE-2021-33771, both Windows kernel elevation-of-privilege vulnerabilities disclosed in July 2021. Google TAG also linked Candiru to Chrome V8 exploitation including CVE-2021-21166 and CVE-2021-30551, and Microsoft linked the company to CVE-2021-33742, an MSHTML remote code execution vulnerability.

In 2022, Avast linked Candiru to CVE-2022-2294, a Chrome and Android V8 heap buffer overflow that was also used in a zero-day exploit chain. This history is significant because it demonstrates that Candiru has maintained access to browser-to-Windows exploit chains capable of the kind of final compromise stage that AdFection's delivery method requires.

The fact that no new CVE has been publicly attributed to the 2024 to 2025 AdFection campaign means either the operator used previously undisclosed vulnerabilities that remain unpatched, or they used known vulnerabilities against unpatched targets. Citizen Lab has not revealed which scenario applies.

Candiru's infrastructure layers

Candiru's operational infrastructure separates three functional layers. Validator servers profile and confirm target eligibility before exploitation. Exploit and infection infrastructure delivers the exploit chain and implants the malware. Command and control servers communicate with deployed implants for tasking and exfiltration.

Citizen Lab developed an HTTP-response fingerprint for Candiru's validator servers and, using historical Censys data, identified approximately 305 domain names across 319 IP addresses associated with that fingerprint between August 2022 and July 2026. The fingerprint began disappearing during May to June 2026, which could indicate Candiru modified its infrastructure after realizing the fingerprint was detectable.

In the confirmed Al Jazeera infection, Citizen Lab recovered a Windows DLL with SHA-256 hash 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. That DLL contained hard-coded infrastructure matching Citizen Lab's Candiru C2 fingerprint, including the domains fearevolve[.]com and jobmarcher[.]com, providing one of the strongest pieces of attribution evidence.

From Candiru to Integrity Labs

Citizen Lab reports that Candiru has been rebranded as Integrity Labs. Recorded Future previously identified Integrity Labs Ltd, an Israeli company incorporated in December 2024, during its investigation of Candiru's DevilsTongue infrastructure. Israeli media reported that U.S.-based Integrity Partners acquired Candiru's operations in 2025 for approximately 30 million dollars, though Citizen Lab says the current status of that acquisition remains unclear.

The corporate rebranding is operationally significant. The Entity List designation applies to Candiru and Saito Tech, but the extent to which a new corporate entity called Integrity Labs is subject to the same restrictions is a legal question that depends on the specific terms of any acquisition and how the U.S. Commerce Department interprets successor entities.

What is clear from the offensive perspective is that the DevilsTongue infrastructure continued operating through 2025, and the AdFection delivery method documented in 2026 demonstrates that the operational capability behind Candiru remains active regardless of the corporate name on the door.

Frequently asked questions

Related research