Caramel TsunamiThreat actor
- Candiru
- sourgum
Caramel Tsunami is a threat actor that specializes in spyware attacks. They have recently resurfaced with an updated toolset and zero-day exploits, targeting specific victims through watering hole attacks. Candiru has been observed exploiting vulnerabilities in popular browsers like Google Chrome and using third-party signed drivers to gain access to the Windows kernel.From MISP Galaxy
Last reported yesterday, by CyberScoop9 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1027.018Invisible Unicode
“Invisible Unicode characters: With the rise of AI email assistants, threat actors are going back to their bag of tricks from the early 2000s and we're seeing a rise in attacks leveraging invisible Unicode characters.”
- T1176.001Browser Extensions
“Organizations facing elevated targeting risks should consider stricter controls on advertising, browser extensions and third-party content, especially on systems used to access confidential information.”
- T1505.003Web Shell
“The zero-day has been used to plant web shells on Nextcloud servers where the app was installed since at least September.”
- T1684Social Engineering
“This method significantly reduces the risk of detection and failure, as it does not rely on preemptive social engineering.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Senators say targeted ads are a security risk. Ad groups say the critics are off base.“…he Citizen Lab report also urges regulators to take action, including conducting an investigation of Discover-Tech and the spyware firm Candiru, which infect users through Discover-Tech online ads; “more closely scrutinize the advertising ecosystem to determine whether other comp…”
-
Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel“Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel”
-
Risky Bulletin: Russia arrests DataSuckers hacking group“Al Jazeera employees targeted with Candiru spyware: An Israeli advertising company named Discover-Tech has helped spyware maker Candiru deploy its payloads via targeted ads.”
-
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads“Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads”
-
Spyware vendors found a way to make targeted ads even worse“One spyware vendor linked to the operation is Candiru, the Israeli developer now known as Integrity Labs.”
-
AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks“The investigation links Discover-Tech to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021.”
-
AdFection: How mercenary spyware invades victims’ devices through targeted advertising“…egitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru.”
-
ADINT: From Ad-Based Geolocation Tracking to Intrusion Vector“…pany Insanet developed "Sherlock", an ad-based infection vector subsequently reported by Haaretz in 2023 and identified as bundled with Candiru's DevilsTongue spyware.”
-
Predators for Hire: Commercial Surveillance Vendors Overview“Others also have Desktop branches, such as Candiru (known as Karkadann), which has been active since at least 2020.”
Indicators in its reports
named in the reports above- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
- kevincollier.bsky[.]socialin 1 report
- 255869de85e2a171…f2fa2d595cc8in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.