Candiru Infrastructure: Validator, Exploit and C2 Layers
Candiru's operational infrastructure separates three functional layers: validator servers that profile and confirm target eligibility, exploit/infection infrastructure, and command-and-control (C2) servers that communicate with deployed implants. Citizen Lab identified 305 validator-associated domains across 319 IPs matching its V1 fingerprint between August 2022 and July 2026.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Three layers
Profiles and confirms target eligibility before exploitation.
Delivers the exploit chain and implants the malware.
Communicates with deployed implants for tasking and exfiltration.
V1 fingerprint research
Citizen Lab's historical infrastructure research identified 305 distinct validator-associated domain names across 319 IP addresses matching its V1 fingerprint between August 2022 and July 2026. The fingerprinting behavior appeared to begin disappearing during May–June 2026. The V1 fingerprint matched specific HTTP response banners observable on internet-scan services such as Censys; example validator domains include keyadapter[.]com and sharethere[.]net. The HTTP fingerprint is treated here as historical defensive threat-intelligence material. See the validator servers page.
C2 in the AdFection case
Four C2 servers cited in the 2026 report include fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, and plasticbells[.]com. The recovered Windows DLL hard-coded fearevolve[.]com and jobmarcher[.]com. See the C2 page and the IOC database.
Discover-Tech domain families
Citizen Lab identified several Discover-Tech-related domain families useful for threat hunting. Eskimi separately identified suspicious loaders including dtech.adtimizer[.]co and several mtrtb[.]com loader subdomains. Treat these as historical research indicators rather than blindly blocking every parent domain without context.
Last updated 2026-10-18
