Inskit Researchers Uncover Clusters in Hungary, Saudi Arabia
Security researchers uncovered a previously unseen malware cluster associated with Israeli spyware maker Candiru, indicating the company may have rebranded itself to evade sanctions to continue its operations.
See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments
Researchers from Recorded Future’s Insikt Group identified malicious Candiru clusters in Hungary and Saudi Arabia, believed to be part of a broader infrastructure used to deploy the remote access implant dubbed DevilsTongue by Microsoft. The Israeli-based spyware startup was launched by former NSO Group employees in 2014, and focuses on exploiting zero-day vulnerabilities.
In addition to the clusters in Hungary and Saudi Arabia, researchers uncovered six more previously unreported infrastructure clusters linking the spyware vendor to Indonesia and Azerbaijan.
“Eight distinct clusters were identified. Five are assessed as highly likely to be currently active, including ones associated with Hungary and Saudi Arabia,” Insikt researchers said. “One cluster, highly likely linked to a customer based in Indonesia, was active until November 2024, while two others, associated with Azerbaijan, remain of uncertain status.”
DevilsTongue is a Windows-based spyware which enables deep access to infected devices. Its capabilities include file extraction, browser data harvesting and the theft of encrypted messages, including from the Signal desktop app. Candiru malware typically gains control through zero-day exploitation and has been linked to a Google Chrome hack in Armenia and the Middle East.
Due to its high cost and technical sophistication, Insikt researchers estimate the tool was likely used to target high-value individuals like politicians, business leaders, or individuals in sensitive government roles, the researchers said.
A suspected Candiru victim in Hungary includes Daniel Freund, a member of the European Parliament and a strong critic of Hungarian Prime Minister Viktor Orbán.
Candiru appears to continue to operate despite its inclusion in 2021 onto an exports blacklist by the United States. The designation restricts the company from accessing U.S.-origin technologies and goods, part of a broader effort to curb the global proliferation of spyware.
CT Tech reported in April that investment firm Integrity Partners acquired Candiru’s operations for $30 million, transferring technology and employees to a new entity not on a U.S. blacklist.
Since its inception, the company has been rebranded several times – to Grindavik Solutions in 2018, to Taveta Ltd in 2019. In 2020, the company created a subsidiary named Sokoto.
“Rebranding and re-selling are common tactics used by spyware vendors to obscure their identities, bypass export controls and mitigate reputational risk,” said Nitansha Bansal, assistant director with the Cyber Statecraft Initiative at the Atlantic Council Tech Programs. “They change legal names, shift corporate structures and create subsidiaries or partner relationships to exploit jurisdictional loopholes and evade enforcement,” Bansal told Information Security Media Group.
Another common tactic deployed by commercial spyware companies is jurisdiction hopping through acquisitions to evade legal restrictions, a September 2024 Atlantic Council report found.
Despite increasing scrutiny from the U.S. and Europe, including the Pall Mall Process and the formation of a U.S.-led international coalition to counter spyware, the commercial spyware industry continues to thrive. International efforts have largely focused on voluntary norms such as limiting spyware export controls to autocratic countries, often resulting in inconsistent enforcement.
“To effectively counter spyware proliferation, countries, especially within the EU, which hosts nearly 30% of known spyware vendors, Europe must harmonize export licensing policies and adopt standardized corporate registries,” Bansal said. “These measures would make it more difficult for vendors to hide behind shell companies or rebrand without detection by law enforcement.”