Candiru / Saito Tech

Sold to / Operational in:

Also Operates in:
Armenia, Austria, Iran, Israel, Lebanon, Palestine, Russia, Slovenia, Yemen

Main Products:

Candiru Spyware, Sherlock

Skip to:

Candiru / Saito Tech

Candiru changed its name to Saito Tech ltd. We will refer to them as “Candiru” as they are most well known by that name.

————————————————————————-

General Information

Candiru was founded in 2014 by Eran Shorer and Yaakov Weizman and is based in Tel Aviv, Israel. The largest shareholder and chairman is Isaac Zach, who was also a founding funder of the NSO Group.[1]Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed [2]Israeli spyware firm linked to fake Black Lives Matter and Amnesty websites – report

Candiru offers cyber-attacks-as-a-service where people can sell and hire offensive cyber tools for hacking computer networks. Candiru is known to sell hacking technology for those who want to spy on phones and computers. Candiru offers its clients — international, mainly from Europe — a thorough and complete cybersystem that customers can use to see exactly how many targets have been penetrated by their hacks and what information has been obtained.[3]WhatsApp’s security breach: Made in Israel, implemented worldwide

Candiru’s specialty, hacking Microsoft Windows for nation-state intelligence agencies, is one key revenue stream. And one of those Candiru customers is almost certainly Uzbekistan, according to Brian Bartholomew, a researcher at Russian cybersecurity company Kaspersky Lab. He claimed that a lapse in an Uzbekistan intelligence agency’s operational security allowed him to link multiple Windows vulnerabilities used in Uzbek attacks back to Candiru and two other customers: Saudi Arabia and the U.A.E.[4]Meet Candiru — The Mysterious Mercenaries Hacking Apple And Microsoft PCs For Profit Human rights experts have now raised the alarm about Candiru’s customer base and the potential for abuse. Bartholomew and another source with knowledge of the attacks said he discovered Candiru surveillance software was used in previously reported hacks on Uzbek human rights activists and independent media.[5]CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus

TheMarker Claims that NSO is also a customer of Candiru as it is often seen contacting the surreptitious firm for some espionage-related projects. Two industry sources said the main Candiru financial backer was Founders Group, cofounded by one of the three men who set up NSO, Omri Lavie.(Meet Candiru — The Mysterious Mercenaries Hacking Apple And Microsoft PCs For Profit))

According to information from court filings of a lawsuit filed against Candiru by a former senior employee the company’s 2018 revenues were worth about $20 million and the company has around 150 employees.[6]Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed According to reporting from December 2019, Candiru’s market capitalisation was $90 million (based on the sale of a 10% stake in Candiru which was sold by venture capitalist Eli Wartman to Universal Motors for $9 million).[7]Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed

Like other companies in Israel’s renowned cybersecurity industry, Candiru recruits heavily from the Israel Defense Forces 8200 intelligence unit.[8]Top Secret Israeli Cyberattack Firm, Revealed

A document appended to the lawsuit suggests that the company was in negotiations with potential clients from over 60 countries with a total value of $367 million.[9]Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed

The New York Times reported in 2021 that Israel has continued to allow and even encourage cyber-surveillance companies to secretly work with Saudi Arabia, despite recurring reports that Israeli tech was being used to clamp down on dissent and target opposition figures, including possible ties to the killing of dissident journalist Jamal Khashoggi. According to the report, one of the firms given permission by the Defense Ministry to work with Saudi Arabia was Candiru.[10]Report: Israel pushed spyware firms to work with Saudis despite Khashoggi murder

In July 2021 Microsoft said it issued a software update to block spy tools developed by the firm that were allegedly used to snoop on over 100 people worldwide, including dissidents, activists and journalists. Microsoft said people targeted in “precision attacks” by the spyware were located in the Palestinian territories, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia and Singapore. Citizen Lab said Candiru’s spyware infrastructure included websites “masquerading as advocacy organizations” such as Amnesty International and Black Lives Matter.[11]Citizenlab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus

Candiru, in addition to Israeli NSO Group, was in November 2021 by the United States for activities contrary to U.S. national security or foreign policy interests.[12]Israel’s Candiru Hacking Tools Used Against Middle East and U.K. Sites, Report Says

In November 2021 the cibersecurity firm ESET reported that technology made by Candiru was used to hack news sites in the Middle East and United Kingdom, in order to gain access to their users. According to the research, the hack began in March 2020 and continued through August 2021. It targeted about 20 websites, including Middle East Eye, a Britain-based news website that focuses on the Middle East and Africa. The websites, however, were not the final target. According to ESET, the hackers used what is called a watering hole attack to gain access to the websites’ visitors.[13]Israel’s Candiru Hacking Tools Used Against Middle East and U.K. Sites, Report Says

TechInquiry published in 2022 documentation of the US Federal Lobbying Communications, where it is shown that Candiru signed five lobbying registrations with a total income of $140,000.[14]Techinquiry : Candiru – US Federal Lobbying Communications

In 2023 it was reported that Candiru has been targeting people in Lebanon, Turkey, Yemen and Palestine since March 2022. with a new toolset that includes zero-day exploits specifically designed for Google Chrome. In Lebanon, it was reported, journalists were targeted by Candiru.[15]New Candiru attack targets journalists in the Middle East

Acquisitions / Subsidiaries / Fundings

Candiru makes efforts to keep its operations, infrastructure, and staff identities opaque to public scrutiny.

Several investment funds ties to Qatar Investment Authority.

Candiru has at least one subsidiary – Sokoto, which was incorporated in March 2020.[16]CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus

A number of independent investors appear to have funded Candiru’s operations over the years. As of Candiru’s notice of allotment of shares filed in February 2021 with the Israeli Corporations Authority, Zack, Shorer, and Weitzman are still the largest shareholders. Three organizations are the next largest shareholders: Universal Motors Israel ltd.(Israel), ESOP Management and Trust Services (Israel),  and Optas Industry Ltd.(Malta).[17]CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus

In addition to the involvement of Zack, Candiru shares other points of commonality with NSO Group, including representation by the same law firm and utilization of the same employee equity and trust administration services company.[18]CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus

Usage by Israeli Forces

According to Citizenlab Candiru Cybersystems were being operated in Israel.[19]CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus

References
1 Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed
2 Israeli spyware firm linked to fake Black Lives Matter and Amnesty websites – report
3 WhatsApp’s security breach: Made in Israel, implemented worldwide
4 Meet Candiru — The Mysterious Mercenaries Hacking Apple And Microsoft PCs For Profit
5 CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus
6 Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed
7 Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed
8 Top Secret Israeli Cyberattack Firm, Revealed
9 Cellphone Hacking and Millions in Gulf Deals: Inner Workings of Top Secret Israeli Cyberattack Firm Revealed
10 Report: Israel pushed spyware firms to work with Saudis despite Khashoggi murder
11 Citizenlab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus
12 Israel’s Candiru Hacking Tools Used Against Middle East and U.K. Sites, Report Says
13 Israel’s Candiru Hacking Tools Used Against Middle East and U.K. Sites, Report Says
14 Techinquiry : Candiru – US Federal Lobbying Communications
15 New Candiru attack targets journalists in the Middle East
16 CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus
17 CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus
18 CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus
19 CitizenLab : Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus