Citizen Lab: Spyware by Israel’s Candiru used to target activists

At least 100 activists, journalists and dissidents in 10 countries were targeted by Candiru spyware, says Citizen Lab.

At least 100 activists, journalists and government dissidents across 10 countries were targeted with spyware produced by an Israeli company called Candiru, according to cybersecurity researchers at the University of Toronto’s Citizen Lab, which tracks illegal hacking and surveillance. Using a pair of vulnerabilities in Microsoft Corp.’s Windows, cyber operatives operating in Saudi Arabia, Israel, Hungary, Indonesia and elsewhere purchased and installed remote spying software made by Candiru, according to the researchers. The tool was used in “precision attacks” against targets’ computers, phones, network infrastructure and internet-connected devices,” said Cristin Goodwin, general manager of Microsoft’s Digital Security Unit. Microsoft was alerted to these attacks by researchers at Citizen Lab, and after weeks of analysis, the company released patches on July 13 for a pair of Windows vulnerabilities believed to be the point of entry for the spyware, according to a Microsoft blog published Thursday. Microsoft doesn’t name Candiru but instead refers to an “Israel-based private sector offensive actor” it calls Sourgum.