Budapest Post

Cum Deo pro Patria et Libertate
Budapest, Europe and world news

Israeli firm’s spyware linked to attacks on websites in UK and Middle East

Israeli firm’s spyware linked to attacks on websites in UK and Middle East

Canada-based researchers say new evidence suggests Candiru’s software used to target critics of autocratic regimes
Researchers have found new evidence that suggests spyware made by an Israeli company that was recently blacklisted in the US has been used to target critics of Saudi Arabia and other autocratic regimes, including some readers of a London-based news website.

A report by Montreal-based researchers from Slovakian company Eset, an internet security firm, found links between attacks against high-profile websites in the Middle East and UK, and the Israeli company Candiru, which has been called Israel’s “most mysterious cyberwarfare company”.

Candiru and NSO Group, a much more prominent Israeli surveillance company, were both added to a US blacklist this month after the Biden administration took the rare step of accusing the firms of acting against US national security interests.

The Eset report revealed new information about so-called “watering hole attacks”. In such attacks, spyware users launch malware against ordinary websites that are known to attract readers or users who are considered “targets of interest” by the user of the malware.

The sophisticated attacks allow the malware user to identify characteristics about the individuals who have visited the website, including what kind of browser and operating system they are using. In some cases the malware user can then launch an exploit that allows them to take over an individual target’s computer.

Unlike NSO Group’s signature spyware, which is called Pegasus and infects mobile phones, Candiru’s malware is believed by researchers to infect computers. The company appears to be named after a parasitic freshwater catfish that can be found in the Amazon.

The researchers found that the websites that were “known targets” of this kind of attack included Middle East Eye, a London-based news website, and multiple websites associated with government ministries in Iran and Yemen.

Candiru did not respond to the Guardian’s request for comment.

Middle East Eye condemned the attacks. In a statement, its editor-in-chief, David Hearst, said the outlet was no stranger to attempts to take the website down by state and non-state actors.

“Substantial sums of money have been spent trying to take us out. This has not stopped us reporting what is going on in all corners of the region and I am confident that they will not stop us in future,” he said.

Once websites are compromised, researchers at Eset say, they are considered “jumping off sites” that help malware users target individuals. In other words, not every individual who visited one of the compromised websites would have been in danger of being hacked, but users of the malware are believed to have used the websites as a starting point to help identify a much smaller group of individuals who were then targeted.

Matthieu Faou, who uncovered the campaigns, said Eset developed a custom in-house system in 2018 to uncover “watering holes” on high-profile websites. In July 2020, the system notified them that an Iranian embassy website in Abu Dhabi had been tainted with malicious code.

“Our curiosity was aroused by the high-profile nature of the targeted website, and in the following weeks we noticed that other websites with connections to the Middle East were also targeted,” Faou said.

The “threat group” then “went quiet” until it resurfaced in January 2021 and was active until late summer in 2021, when all the websites that were observed to have been victims of attacks were then “cleaned”, Eset said.

Eset said it believed hacking activities ended in late July 2021 after a report by researchers at Citizen Lab, released in conjunction with Microsoft, detailed Candiru’s alleged surveillance activities. That report accused Candiru of selling spyware to governments linked to fake Black Lives Matter and Amnesty International websites that were used to hack targets.

In the July 2021 report, Citizen Lab, a research group affiliated with the University of Toronto, said the Tel Aviv-based Candiru made “untraceable” spyware that could infect computers and phones.

At the time, Candiru declined to comment.

Microsoft said in July that it appeared that Candiru sold the spyware that enabled the hacks, and that the governments generally chose who to target and ran the operations themselves. The company also announced at the time that it had disabled the “cyberweapons” of Candiru and built protections against the malware, including issuing a Windows software update.

There is little public information available about Candiru, which was founded in 2014 and has undergone several name changes. In 2017 the company was selling its malware to clients in the Gulf, western Europe and Asia, according to a lawsuit reported in an Israeli newspaper. Candiru may have deals with Uzbekistan, Saudi Arabia and the UAE, Forbes has reported.

Microsoft reported that it had found victims of the spyware in Israel and Iran. Citizen Lab said it was able to identify a computer that had been hacked by Candiru’s malware, and then used that hard drive to extract a copy of the firm’s Windows spyware. The owner of the computer was a “politically active” individual in western Europe, it said.

This month Candiru made headlines after the Biden administration announced it had added the company to the commerce department’s entity list, a blacklist usually reserved for America’s worst enemies, including Chinese and Russian hackers.

In its press release, the commerce department said it had evidence that Candiru developed and supplied spyware to foreign governments that used it to maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers. The tools also helped to enable foreign governments to conduct “transnational repression”, the department said.

Candiru has not commented on its placement on the entity list.
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
Newsletter

Related Articles

0:00
0:00
Close
Trump Threatens Retaliatory Tariffs After EU Imposes €2.95 Billion Fine on Google
Tesla Board Proposes Unprecedented One-Trillion-Dollar Performance Package for Elon Musk
Gold Could Reach Nearly $5,000 if Fed Independence Is Undermined, Goldman Sachs Warns
Uruguay, Colombia and Paraguay Secure Places at 2026 World Cup
Trump Administration Advances Plans to Rebrand Pentagon as Department of War Instead of the Fake Term Department of Defense
Big Tech Executives Laud Trump at White House Dinner, Unveil Massive U.S. Investments
Tether Expands into Gold Sector with Profit-Driven Diversification
‘Looks Like a Wig’: Online Users Express Concern Over Kate Middleton
Florida’s Vaccine Revolution: DeSantis Declares War on Mandates
Trump’s New War – and the ‘Drug Tyrant’ Fearing Invasion: ‘1,200 Missiles Aimed at Us’
"The Situation Has Never Been This Bad": The Fall of PepsiCo
At the Parade in China: Laser Weapons, 'Eagle Strike,' and a Missile Capable of 'Striking Anywhere in the World'
The Fashion Designer Who Became an Italian Symbol: Giorgio Armani Has Died at 91
Putin Celebrates ‘Unprecedentedly High’ Ties with China as Gazprom Seals Power of Siberia-2 Deal
China Unveils New Weapons in Grand Military Parade as Xi Hosts Putin and Kim
Rapper Cardi B Cleared of Liability in Los Angeles Civil Assault Trial
Google Avoids Break-Up in U.S. Antitrust Case as Stocks Rise
Couple celebrates 80th wedding anniversary at assisted living facility in Lancaster
Information Warfare in the Age of AI: How Language Models Become Targets and Tools
The White House on LinkedIn Has Changed Their Profile Picture to Donald Trump
"Insulted the Prophet Muhammad": Woman Burned Alive by Angry Mob in Niger State, Nigeria
Trump Responds to Death Rumors – Announces 'Missile City'
Druzhba Pipeline Incident Sparks Geopolitical Tensions
Cost of Opposition Leader Péter Magyar's Economic Plan Revealed
Germany in Turmoil: Ukrainian Teenage Girl Pushed to Death by Illegal Iraqi Migrant
United Krack down on human rights: Graham Linehan Arrested at Heathrow Over Three X Posts, Hospitalised, Released on Bail with Posting Ban
Asian and Middle Eastern Investors Avoid US Markets
Ray Dalio Warns of US Shift to Autocracy
Eurozone Inflation Rises to 2.1% in August
Russia and China Sign New Gas Pipeline Deal
Von der Leyen's Plane Hit by Suspected Russian GPS Interference in an Incident Believed to Be Caused by Russia or by Pro-Peace or by Anti-Corruption European Activists
China's Robotics Industry Fuels Export Surge
Suntory Chairman Resigns After Police Probe
Gold Price Hits New All-Time Record
UK Fintechs Explore Buying US Banks
Greece Suspends 5% of Schools as Birth Rate Drops
Apollo to Launch $5 Billion Sports Investment Vehicle
Bolsonaro Trial Nears Close Amid US-Brazil Tension
European Banks Push for Lower Cross-Border Barriers
Poland's Offshore Wind Sector Attracts Investors
Budapest Central European Fashion Week Kicks Off
U.S. Celebrates Labor Day
Hungarian National Team Captain Scores Epic Goal
EU is getting aggressive: Four AfD Candidates Die Unexpectedly Ahead of North Rhine-Westphalia Local Elections
Japanese Customer Sways from VW to BYD after “Unbelievable” Test Drive amid Dealership Expansion
Nestlé Removes CEO Laurent Freixe Following Undisclosed Relationship with Subordinate
Pickles are the latest craze among Generation Z in the United States.
Giuliani Seriously Injured in Accident – Trump to Award Him the Presidential Medal of Freedom
Deadline Day Delivers Record £125m Isak Move and Donnarumma to City
Nvidia Reveals: Two Mystery Customers Account for About 40% of Revenue
×