Skip to content
On Sale AdFection Full Tech : 1 BTC. Includes Full Source Codes, Technical Blueprints, Exploits
ADFECTION.RESEARCH
CONFIRMED// Citizen Lab, Microsoft, Commercev1.0

Candiru Spyware: Complete Technical History, Infrastructure, Exploits and DevilsTongue Analysis

Candiru is an Israel-based mercenary spyware vendor — a private-sector offensive actor — that sells surveillance capabilities to government customers. Its Windows implant was named DevilsTongue by Microsoft, and the actor has also been designated SOURGUM. Candiru was added to the U.S. Entity List in November 2021 and was linked in October 2026 to the AdFection advertising-delivery pipeline.

Published
2026-10-15
Last reviewed
2026-10-18
Last updated
2026-10-18
Evidence
CONFIRMED
Entity dossier
Type: Mercenary spyware vendor / private-sector offensive actor
Associated names: Candiru · Saito Tech · SOURGUM · Integrity Labs
Primary implant: DevilsTongue (Windows)
Platforms: Windows prominently documented; "Sherlock" claimed multi-platform zero-click vector
U.S. Entity List: November 2021
First public exposure: July 2021

What Candiru is

Candiru is an Israel-based mercenary spyware vendor — a private-sector offensive actor (PSOA) — that develops and licenses surveillance capabilities to government customers. The company has operated under several corporate identities, including Saito Tech and, per Recorded Future's 2025 investigation, Integrity Labs. Microsoft assigned the threat-actor designation SOURGUM to the actor and the name DevilsTongue to its Windows implant.

Candiru sits in the same commercial spyware market as NSO Group (Pegasus), Intellexa (Predator), and others. Its licensing model, as reported, involves selling access to its platform to government customers who then conduct operations, with Candiru providing infrastructure and maintenance.

Corporate history & aliases

Candiru's early corporate history traces to approximately 2014. The company has operated under multiple corporate aliases, including Saito Tech. In 2025, Recorded Future identified Integrity Labs Ltd while investigating Candiru-linked infrastructure, and Citizen Lab's 2026 report discusses Candiru operating under the Integrity Labs identity and reports that in 2025 U.S.-based Integrity Partners acquired Candiru's assets for up to approximately $30 million and transferred them, along with employees, to a new entity (Integrity Labs Ltd.) positioned outside the Entity List sanctions. The acquisition status is not fully resolved in public sources; where uncertain, this site says so. See the Integrity Labs page.

Timeline

2014
Early corporate history
Early corporate antecedents of the company later known publicly as Candiru.
2021-07
Hooking Candiru
Citizen Lab publishes the first public technical exposure of the Candiru spyware vendor.
2021-07
Microsoft DevilsTongue analysis
Microsoft Threat Intelligence publishes technical analysis of the DevilsTongue Windows implant and the SOURGUM actor designation.
2021-07
Zero-day patches
Multiple zero-day vulnerabilities associated with Candiru activity are patched across Windows and Chrome.
2021-11
U.S. Entity List
The U.S. Department of Commerce adds Candiru (Saito Tech) to the Entity List.
2022
Catalan investigations
Candiru targeting is reported in investigations involving Catalan civil society.
2022-07
Avast / CVE-2022-2294
Avast documents Candiru-linked exploitation of a Chrome/Android V8 heap buffer overflow.
2025
Recorded Future infrastructure investigation
Recorded Future / Insikt Group publishes infrastructure intelligence and identifies the Integrity Labs corporate identity.
2026-10
Citizen Lab Report 195 (AdFection)
Citizen Lab documents AdFection — targeted advertising as a Candiru delivery pipeline — and the Al Jazeera attacks.

See the full interactive timeline.

Documented zero-days & CVEs

Multiple zero-day vulnerabilities have been publicly associated with Candiru activity, patched across Windows and Chrome in 2021 and 2022. The table below summarizes them; full defensive detail is on the CVE database.

CVEProductTypeYear
CVE-2021-31979Microsoft WindowsElevation of privilege2021
CVE-2021-33771Microsoft WindowsElevation of privilege2021
CVE-2021-21166Google ChromeV8 / memory2021
CVE-2021-30551Google ChromeV8 type confusion2021
CVE-2021-33742Microsoft Windows / MSHTMLRemote code execution2021
CVE-2022-2294Google Chrome / Android (V8)Heap buffer overflow2022

Infrastructure

Candiru's operational infrastructure separates three functional layers: validator servers (which profile and confirm target eligibility), exploit/infection infrastructure, and command-and-control (C2) servers that communicate with deployed implants. Citizen Lab's historical infrastructure research identified 305 distinct validator-associated domain names across 319 IP addresses matching its V1 fingerprint between August 2022 and July 2026, and noted this fingerprinting behavior appeared to begin disappearing during May–June 2026. Explore the infrastructure database and validator research.

DevilsTongue

DevilsTongue is the name Microsoft assigned to Candiru's sophisticated modular Windows spyware. It is a C/C++ implant with a multi-stage, modular architecture, user-mode and kernel-mode capability, encrypted components decrypted in memory, COM-hijacking persistence, and extensive browser, credential, and messaging data collection. For the full analysis, see the DevilsTongue pillar.

2026: AdFection

In October 2026, Citizen Lab's AdFection report linked Candiru to a new delivery pipeline: targeted advertising infrastructure operated by Discover-Tech, with the Controlium targeting platform, routing selected devices through Candiru validator infrastructure to Candiru C2. The report documented attacks against Al Jazeera during 2024–2025 and recovered a Windows DLL attributed to Candiru through functional overlap with earlier DevilsTongue samples. See the AdFection pillar.

U.S. Entity List

On November 3, 2021, the U.S. Department of Commerce Bureau of Industry and Security added Candiru (Saito Tech) to the Entity List, restricting the export, reexport, or transfer of U.S.-origin items to the company. The listing cited the company's role in supplying spyware to foreign governments that used the tools to surveil dissidents, journalists, and others.

Relationship summary

  • Candiru → DevilsTongue: developer of the Windows implant Microsoft named DevilsTongue.
  • Candiru → Integrity Labs: later corporate identity identified by Recorded Future (2025) and discussed by Citizen Lab (2026).
  • Candiru → AdFection: the spyware delivered through the AdFection advertising pipeline.
  • Candiru → Discover-Tech: linked via the AdFection delivery chain.
  • Candiru → CVEs: multiple 2021–2022 zero-days.
References
  1. [1] Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — Citizen Lab, 2026-10-15
  2. [2] Hooking Candiru: An Analysis of a New Israeli Spyware Vendor — Citizen Lab, 2021-07-15
  3. [3] DevilsTongue: A New Market for Mercenary Spyware — Microsoft Threat Intelligence, 2021-07-13
  4. [4] Google TAG research on Candiru zero-day campaigns — Google Threat Analysis Group, 2021
  5. [5] Return of Candiru (CVE-2022-2294) — Avast / Gen Digital Threat Labs, 2022-07
  6. [6] Tracking Candiru's DevilsTongue Spyware in Multiple Countries — Recorded Future / Insikt Group, 2025
  7. [7] ADINT / weaponized ad-tech investigation — Confiant Threat Intelligence, 2026
  8. [8] Intellexa 'Aladdin' advertising-based spyware delivery research — Amnesty International Security Lab, 2025-12
  9. [9] Candiru Entity List announcement — U.S. Department of Commerce, Bureau of Industry and Security, 2021-11-03
  10. [10] CVE entries for Candiru-associated vulnerabilities — NIST National Vulnerability Database, 2021-2022
  11. [11] ESET research on Candiru / DevilsTongue activity — ESET, 2021-2022
→ DevilsTongue→ AdFection→ CVE Database→ Integrity Labs
SYSTEM ONLINE — SECURE CHANNEL

Professional

Spy Phones

ZERO-CLICK

Spyware

Android phones and iPhones Zero Day Spyware for remote surveillance, lawful interception, Parental Control and MDM corporate compliance monitoring — the ultimate Zero-Click Spyware for authorized investigative and cyber intelligence operations.

Professional Spy Phones — Zero-Click Spyware
DEVICE STATUS: ACTIVE