Candiru
actor · actor:candiru
Israeli mercenary spyware vendor, rebranded Integrity Labs; Citizen Lab links with high confidence the spyware delivered to Al Jazeera devices through Discover-Tech ads to a newer version of the Candiru chain it documented in 2021 (Citizen Lab, 2026-10-15).
Aliases: Integrity Labs
Coverage
1
first 2026-10-16 → last 2026-10-16
Latest activity
2026-10-16
Citizen Lab: spyware delivery through targeted ads, with defence and government networks among the impressions
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, defense, media
Sources cited
2
2 hosts
Defender insights
What each entry about Candiru tells a defender to do, newest first.
Relationships explore in graph
Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.
collaborates with
- Discover-TechCitizen Lab links with high confidence the spyware delivered through Discover-Tech ads to Candiru
Story timeline
ATT&CK techniques (6 across 7 tactics)
6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
- ReconnaissanceGather Victim Host Information
- Resource DevelopmentAcquire Infrastructure: Malvertising
- Initial AccessDrive-by Compromise
- PersistenceEvent Triggered Execution: Component Object Model Hijacking
- Privilege EscalationEvent Triggered Execution: Component Object Model Hijacking
- StealthObfuscated Files or Information
- Command and ControlApplication Layer Protocol: Web Protocols
Reconnaissance TA0043
T1592Gather Victim Host Information×1
Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Resource Development TA0042
T1583.008Acquire Infrastructure: Malvertising×1
Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Initial Access TA0001
T1189Drive-by Compromise×1
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Persistence TA0003
T1546.015Event Triggered Execution: Component Object Model Hijacking×1
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Privilege Escalation TA0004
T1546.015Event Triggered Execution: Component Object Model Hijacking×1
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Stealth TA0005
T1027Obfuscated Files or Information×1
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols×1
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Entries about Candiru (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- blog.confiant.com1 (50%)
- citizenlab.ca1 (50%)