Candiru (DevilsTongue) Technical Intelligence Dossier

Executive Summary & Threat Architecture

Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor specializing in advanced zero-day mercenary spyware targeting Microsoft Windows, with modular extensions for macOS, iOS, and Android. Documented and forensically analyzed in July 2021 by The Citizen Lab and Microsoft Threat Intelligence Center (MSTIC), Candiru's primary espionage implant—tracked by Microsoft as 'DevilsTongue' and internally codenamed 'Caramel' or 'Sherlock'—is weaponized by government customers to execute covert surveillance against high-profile journalists, human rights activists, legal counsel, and political opposition figures across Europe, the Middle East, and Latin America. Candiru specializes in zero-click and precision one-click exploit chains: on Windows endpoints, it weaponized browser remote code execution zero-days (such as the Google Chrome WebRTC flaw CVE-2022-2294 discovered by Avast) chained with twin Windows GDI/win32k kernel privilege escalation zero-days (CVE-2021-31979 and CVE-2021-33771) to escape sandboxes and establish SYSTEM-level execution. Once deployed, DevilsTongue acts as an invasive multi-modular surveillance framework: it hooks process memory to extract end-to-end encrypted chat logs (Signal, WhatsApp, Telegram, Skype), harvests saved browser passwords and active session cookies to bypass Multi-Factor Authentication (MFA), exfiltrates Outlook message spools, captures microphone audio and keystrokes, and executes LSASS memory dumping to harvest Kerberos and NTLM credentials for network lateral movement.

Observed Threat Aliases: Candiru Spyware, DevilsTongue, Saito Tech, KANDIRU, Caramel Spyware, Taveta, Grindavik Solutions, Sherlock (Internal Code)

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: candiru surveillance framework

Documented Downstream Variants: devilstongue_windows, caramel_loader, candiru_ios, candiru_android

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Candiru (DevilsTongue) operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Zero-click Chrome WebRTC heap buffer overflow exploitation (CVE-2022-2294)
• Watering-hole URL redirection targeting regional news, diplomacy, and civil society sites
• Spear-phishing delivery leveraging shortened URLs mimicking media and NGO domains

Host Persistence & Execution Hooks

• Process injection into critical Windows daemons (svchost.exe, lsass.exe)
• Exploitation of Windows GDI kernel drivers (CVE-2021-31979, CVE-2021-33771) for ring-0 elevation
• Execution of custom signed/unsigned kernel drivers with anti-forensic log tampering

Reference File Hashes (SHA-256)

• 4e311f59223755ba9e74403cd3b036fa7c617a2fbcfcbb2e0f2f35fe99f927b2
• 92e10db56306e00b3e83b8b1784fbe3efaa447a123f1e917d23d9b0151a66e4a
• a3b1eb887f43398be3bfbb43952baab464010a30bfeee37c68ba02a6ce2bbffb