Candiru (Saito Tech Ltd)

Judge Julia Tortosa Garcia-Vaso, of Barcelona's Court of Instruction Number 2, formally named as investigated persons the former Guardia Civil directors Felix Vicente Azon and Maria Gamez, and the former CNI director Paz Esteban, together with executives of NSO Group and of Saito Tech Ltd - the first time executives of Candiru's company have been investigated in Spain. The alleged offences are 'delitos de descubrimiento y revelacion de secretos informaticos y de acceso ilegal a sistemas informaticos'. The five complainants, organised as the Sentinel Alliance, describe 78 attacks over two years from 2019. The proceedings are at the investigation stage, and no ruling had been published as of 8 August 2026.

A Barcelona court accepted a criminal complaint on 16 September 2025 and opened an investigation phase. Those to be investigated include the former CNI director Paz Esteban, the former Guardia Civil directors Felix Vicente Azon Vilas and Maria Gamez Gamez, the NSO Group directors Shalev Hulio and Omri Lavie, and Isaac Zack as a director of Saito Tech Ltd. The complaint was brought by five businessmen and technology developers coordinated by the Sentinel Alliance victims' association, whose phones were infected 'between 2017 and 2020 on several occasions'. The report states this is the first case explicitly asking the courts to investigate the use of Candiru.

Aggregated account of the ARA report of the same date, recording that Judge Miriam de Rosa Palacio admitted the complaint and found the acts 'could constitute crimes of discovery and disclosure of computer secrets and illegal access to computer systems'. The plaintiffs are seeking declassification of documents by Spain's Council of Ministers, the formal designation of the company directors as investigated persons, and international cooperation - European Investigation Orders to Luxembourg and letters rogatory to Israel - to obtain company documentation and testimony.

The Commission concluded on reasonable grounds that Israeli authorities and security forces have committed and are continuing to commit acts of genocide against Palestinians in the Gaza Strip, and that the State of Israel bears responsibility for the failure to prevent genocide, its commission, and the failure to punish it. The analysis covers Gaza over the period 7 October 2023 to 31 July 2025.

Infrastructure research with an analysis cut-off of 26 June 2025. 'Eight distinct clusters were identified. Five are assessed as highly likely to be currently active, including ones associated with Hungary and Saudi Arabia. One cluster, highly likely linked to a customer based in Indonesia, was active until November 2024, while two others, associated with Azerbaijan, remain of uncertain status.' It records that historic targets 'included politicians, human rights defenders, journalists, academics, embassy staff, and political dissidents', and repeats Microsoft's finding that approximately half of the observed victims were in Palestine. DevilsTongue can steal credentials from browsers, read Signal messages and use stolen cookies to impersonate victims on Facebook, Gmail and VK. It identifies Integrity Labs Ltd, incorporated in Israel on 18 December 2024 and directed by Naftali (Elad) Yoran, as the entity to which Candiru's assets were moved.

Reporting on the Insikt Group findings. Quotes researcher Julian-Ferdinand Vogele that the spyware can theoretically be delivered through malicious links, weaponised files, man-in-the-middle attacks and physical access to a device. Records that Integrity Partners transferred the assets to Integrity Labs Ltd, and that Integrity Partners did not respond to questions.

The Israeli business paper reports that the American investment fund Integrity Partners agreed to buy Candiru's operations for up to $30 million. 'The fund purchased Candiru's assets and transferred them - along with all of the company's employees - to a new entity that is not subject to U.S. government sanctions.' A first phase of $10 million, covering the employee transition, had been completed; the second phase depends on approval of the transfer of Candiru's export licences, which for an Israeli company means the Ministry of Defence. Names Isaac Zack as chairman and largest shareholder, Yaakov Weizmann and Eran Shorer as the 2014 founders, and Elad Yoran as the Integrity Partners partner leading the deal.

The International Court of Justice, the principal judicial organ of the United Nations, found Israel's continued presence in the occupied Palestinian territory unlawful and set out the obligations of states and the consequences for economic and trade dealings that entrench it. This is the framework within which an Israeli company whose every export is licensed by Israel's Ministry of Defence is assessed on this site.

7amleh's report on the industry as a whole, assessing spyware, social media monitoring and biometric surveillance. It finds that the unchecked proliferation of these technologies in the occupied Palestinian territory 'has a repressive impact on the lives of civilians living under military occupation', and that Israeli firms market systems abroad on the strength of their use there. Its recommendations include 'ending mass surveillance of innocent civilians', accountability mechanisms 'for the use, development and production of automated surveillance technologies', and 'a comprehensive global framework to regulate the sale and transfer of these systems'.

Avast's threat research team reported that Candiru had returned with a Chrome zero-day, CVE-2022-2294, used to attack Avast users 'in Lebanon, Turkey, Yemen, and Palestine via watering hole attacks'. In Lebanon the attackers compromised a website used by employees of a news agency. The chain ended in DevilsTongue, described as 'a full-blown spyware' which then attempted to reach the Windows kernel through a second zero-day. Avast reported the flaw to Google on 1 July 2022 and it was fixed in Chrome on 4 July. This is the second independent finding of Palestinian targeting, a year after Microsoft's.

Position paper by 7amleh, the Arab Center for the Advancement of Social Media, a Palestinian digital rights organisation. It traces how United States policy, capital and corporate practice shaped Israel's surveillance industry between 2002 and 2022, and argues that US lawmakers can set global regulatory standards for the sale of surveillance technology. Written by Sophia Goodfriend. Cited here as an instance of a Palestinian organisation directing its ask at the government that holds the most effective regulatory lever over this sector.

Forensic investigation identifying 'at least 65 individuals targeted or infected with mercenary spyware', of whom four were targeted with Candiru: Joan Matamala, whose infection was forensically confirmed, and Elies Campo, Xavier Vives and Pau Escrich, targeted by email. At least two were targeted with both Pegasus and Candiru. Almost all incidents occurred between 2017 and 2020. Citizen Lab does not conclusively attribute the targeting to a specific government, while noting strong circumstantial evidence of a nexus with Spanish authorities. Joan Matamala is one of the five complainants in the Barcelona criminal case.

Three weeks after the Entity List designation, Israel's Ministry of Defence cut the list of countries to which Israeli firms may export offensive cyber tools from 102 to 37, dropping Morocco, Mexico, Saudi Arabia and the United Arab Emirates. The remaining list is largely North America, western Europe, India, Japan, South Korea and Australia. This establishes that the Israeli state, not the company, decides which governments may buy - and that it can and does change that list.

ESET documented two waves of watering-hole attacks, April to July 2020 and January to August 2021, on 21 websites belonging to media outlets in the United Kingdom, Yemen and Saudi Arabia, government institutions in Iran, Syria and Yemen, internet service providers in Yemen and Syria, and aerospace companies in Italy and South Africa. ESET describes 'strong links' to Candiru and a significant likelihood that the operators were Candiru customers, stopping short of definitive attribution. Activity stopped at the end of July 2021, days after the Citizen Lab, Google and Microsoft publications.

Reports ESET's finding that Middle East Eye's own website was used to deliver the attack over two days in April 2020. Contains one of the very few recorded Candiru responses to press questions: an executive said the company's product 'is purposed to help law enforcement agencies to fight terror and crime', that the company does not hack websites, and that its 'licence and the law' prohibit it from operating the product itself. An employee first denied knowledge of the incident and then declined to comment.

The Bureau of Industry and Security announced the addition of 'Candiru (Israel)' to the Entity List by final rule, on evidence that it 'developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers'. The licence review policy is a presumption of denial. The rule was published in the Federal Register on 4 November 2021 as 'Addition of Certain Entities to the Entity List' (2021-24123). Candiru is listed with seven aliases, among them Candiru Ltd and DF Associates.

The strongest single source on this company's Palestinian victims. Microsoft's Threat Intelligence Center states it 'has identified over 100 victims of SOURGUM's malware' and that 'approximately half of the victims were found in Palestinian Authority, with most of the remaining victims located in Israel, Iran, Lebanon, Yemen, Spain (Catalonia), United Kingdom, Turkey, Armenia, and Singapore'. The victims were 'politicians, human rights activists, journalists, academics, embassy workers, and political dissidents'. Microsoft patched two Windows privilege-escalation flaws, CVE-2021-31979 and CVE-2021-33771, in its July 2021 security updates. Microsoft names the actor SOURGUM and records that 'Citizen Lab asserts with high confidence that SOURGUM is an Israeli company commonly known as Candiru'.

The companion investigation by Citizen Lab at the University of Toronto, published the same day as Microsoft's. It identified 'more than 750 websites linked to Candiru's spyware infrastructure', many impersonating Amnesty International, the Black Lives Matter movement, United Nations agencies and news organisations. It records the sequence of company names - Candiru Ltd (2014), DF Associates Ltd (2017), Grindavik Solutions Ltd (2018), Taveta Ltd (2019), Saito Tech Ltd (2020) - and that in a February 2021 share allotment filed with the Israeli Corporations Authority, 'Zack, Shorer, and Weitzman are still the largest shareholders'. From a leaked proposal published by the Israeli outlet TheMarker it records a EUR 16 million package allowing unlimited infection attempts but monitoring of only ten devices at once.

Contemporaneous reporting on the Citizen Lab and Microsoft findings, recording that the spyware was used against human rights defenders, journalists and activists across several countries.

Thomas Brewster's first substantial public account of the company, two years before the Citizen Lab and Microsoft reports. It records that Candiru operated 'largely under the radar' with 'no website and few records available', names Eitan Achlow as chief executive, and identifies Founders Group - co-founded by Omri Lavie, one of NSO Group's three founders - as a financial backer. Brewster links the company to Uzbekistan, Saudi Arabia and the United Arab Emirates as government customers. Achlow did not respond to Forbes.