Actor Profile

Candiru is an Israeli commercial surveillance vendor (mercenary spyware provider) that develops and sells government-grade spyware to state clients. The company was added to the U.S. Commerce Department Entity List (trade blacklist) in 2021 for enabling the targeting of government officials, journalists, and activists. In 2025, Candiru's assets were acquired by U.S. investment firm Integrity Partners and reportedly transferred to a new entity called Integrity Labs, which operates outside the scope of existing sanctions. Candiru's motivation is commercial: selling sophisticated surveillance capabilities to government customers for intelligence and law enforcement operations. The actor is known for developing highly capable spyware that can compromise devices with minimal or no user interaction.

TTPs (Tactics, Techniques, Procedures)

The attack leveraged a novel initial access vector combining programmatic advertising infrastructure with zero-click exploitation. Discover-Tech, an Israeli ad-tech company acting as a front, placed malicious ads across approximately 75,000 mobile apps and 120,000 websites, generating nearly 4 billion ad bids between March-June 2026. Each ad contained callback code that exfiltrated device advertising IDs and IP addresses to Discover-Tech servers for target profiling. When a target device was identified, the server delivered browser or app exploits that executed automatically upon ad load, requiring no user interaction (zero-click). The attack chain proceeded through three stages: (1) contact with Discover-Tech ad server (mtrtb[.]com), (2) connection to Candiru screening server for device validation, and (3) establishment of command-and-control communications. The recovered Windows spyware sample (SHA-256: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) employed code techniques consistent with Candiru tooling analyzed by Citizen Lab in 2021. This represents the first publicly documented case of mercenary spyware delivery via targeted advertising (malvertising), though the technique was previously described in leaked Intellexa documents related to their "Aladdin" tool.

Targets & Patterns

The confirmed targets were staff at Al Jazeera, the Qatar-based international news network, with at least 45 devices targeted during 2024-2025. The media and journalism sector represents a consistent target profile for Candiru customers, aligning with the company's 2021 blacklisting for enabling surveillance of journalists, activists, and government officials. Al Jazeera has been previously targeted by commercial spyware; in 2020, dozens of its journalists' iPhones were compromised with NSO Group's Pegasus spyware in a separate operation. The targeting pattern suggests state-sponsored intelligence collection against media organizations covering sensitive geopolitical issues. While the malicious ads appeared on networks belonging to NATO, the United Nations, EU bodies, government offices in approximately two dozen countries, chipmakers, and other news organizations, ad presence does not confirm infection. Confiant analysis indicated that ads directly linked to Candiru were low-volume and primarily reached home and mobile internet connections rather than institutional networks, suggesting selective targeting rather than mass compromise. The operational client government behind this specific campaign was not identified in the research.

Historical Context

Candiru has been tracked by threat intelligence researchers since at least 2021, when Citizen Lab first analyzed its spyware capabilities and linked infections to targeting of activists and journalists. The U.S. government designated Candiru for trade restrictions in November 2021 alongside NSO Group and other surveillance vendors. The 2025 acquisition by Integrity Partners and asset transfer to Integrity Labs represents a corporate restructuring pattern common among sanctioned spyware vendors seeking to continue operations under new legal entities. This Al Jazeera campaign marks an evolution in Candiru's delivery methods: previous documented infections used different vectors, while this operation represents the first confirmed use of programmatic advertising infrastructure for mercenary spyware delivery. The technique had been theoretically described by security researchers for years and appeared in December 2024 leaked documents from competitor Intellexa regarding their "Aladdin" tool, but this is the first public technical confirmation of live deployment. Al Jazeera's repeat targeting by different commercial spyware vendors (NSO Group in 2020, Candiru in 2024-2025) demonstrates sustained intelligence interest in the organization from multiple state clients.

Defensive Recommendations

  • Monitor network traffic for sequential connections matching the attack pattern: device contact with ad server, followed by screening server, then C2 server. Hunt for connections to known Candiru infrastructure including mtrtb[.]com and indicators published by Citizen Lab and Confiant.
  • Search endpoint systems for the recovered spyware sample (SHA-256: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) and related file artifacts. Conduct forensic analysis of devices belonging to high-risk personnel (journalists, activists, government officials) for signs of compromise.
  • Implement ad-blocking or restrict programmatic advertising on organizational networks, particularly for high-value targets. Consider deploying ad-security solutions that inspect ad content and behavior before rendering, and maintain allowlists of trusted ad vendors.
  • Harden browser and mobile app security configurations to limit zero-click attack surface. Deploy endpoint detection and response (EDR) solutions capable of detecting unusual process execution chains following ad loads, and enable application sandboxing where possible.
  • Establish baseline network behavior for devices used by at-risk personnel. Alert on anomalous outbound connections, particularly to newly registered domains or infrastructure in jurisdictions associated with surveillance vendors. Review advertising ID and device identifier exposure in mobile applications.

---

# Geopolitical Context

Geopolitical Context

The deployment of Candiru spyware against Al Jazeera represents a significant evolution in state-aligned surveillance capabilities, demonstrating how commercial spyware vendors can weaponize the digital advertising ecosystem for zero-click intrusions. The targeting of Al Jazeera—a Qatar-funded media outlet with substantial reach across the Middle East and global audiences—suggests intelligence collection priorities consistent with regional rivalries. The operation's technical sophistication, using Discover-Tech as a front company within legitimate ad networks from 2020 through 2026, indicates sustained investment in covert access methods. Candiru's placement on the U.S. Commerce Entity List in 2021, followed by its 2025 acquisition by U.S.-based Integrity Partners and rebranding as Integrity Labs, illustrates the persistent challenge of regulating the mercenary spyware industry when corporate restructuring can circumvent sanctions frameworks. The infection of at least 45 devices across 2024–2025, combined with Discover-Tech's placement of nearly four billion ad bids reaching 75,000 apps and 120,000 websites—including NATO, UN, and EU networks—demonstrates how surveillance infrastructure built for targeted operations can achieve strategic-scale reconnaissance potential.

State Actor Alignment

Candiru is an Israeli spyware vendor that sells government-grade surveillance tools exclusively to state clients. The company was added to the U.S. Entity List in November 2021 for developing tools used against government officials, journalists, and activists. In 2025, Candiru's assets were reportedly acquired by Integrity Partners, a U.S. investment firm, and transferred to a new entity believed to be Integrity Labs, which currently falls outside existing sanctions. The Citizen Lab assessment links the Al Jazeera infections to Candiru with high confidence based on code analysis matching distinctive techniques from a 2021 sample, but does not attribute the operation to a specific government customer. Discover-Tech, the Israeli advertising firm used as the delivery mechanism, was registered in Israel in 2020 and led by CEO Dekel Boni; it maintained approved vendor status with Google and IAB Europe until October 2026, when both organizations removed the company following disclosure of policy violations. The targeting pattern is consistent with intelligence priorities in the Middle East, where Al Jazeera's editorial stance and Qatar's regional relationships have historically generated adversarial interest from multiple state actors.

Business Impacty pro region

The compromise has immediate implications for press freedom and source protection across the Middle East, where Al Jazeera operates as a primary Arabic-language news network covering politically sensitive conflicts and governance issues. This marks the second confirmed state-aligned spyware operation against Al Jazeera staff, following the 2020 Pegasus infections attributed to NSO Group, indicating persistent targeting. For Europe, the appearance of Discover-Tech's malicious ads on networks of NATO, the European Union, the United Nations, and government offices in approximately two dozen countries—though not proof of infection—demonstrates how ad-tech infrastructure can be exploited to surveil Western institutions. The incident exposes systemic vulnerabilities in the programmatic advertising ecosystem that underpins the commercial internet, with potential implications for any organization relying on ad-supported platforms. Confiant's finding that most directly linked ads reached home and mobile connections rather than institutional networks suggests operational tradecraft designed to target individuals rather than enterprise infrastructure. The case strengthens calls within the EU for stricter oversight of surveillance technology transfers and may accelerate regulatory action on both spyware exports and ad-tech security standards, particularly given IAB Europe's involvement as an industry self-regulatory body.

Forecast

If additional government customers of Candiru/Integrity Labs are identified through forensic analysis of the recovered indicators, pressure is likely to mount on the U.S. administration to extend Entity List restrictions to successor entities and affiliated investment vehicles. Should evidence emerge linking the operation to a specific state actor with diplomatic ties to Western governments, it may trigger bilateral tensions and calls for export control enforcement. If ad networks fail to implement technical controls preventing similar abuse—such as enhanced vetting of callback mechanisms in ad creative—the programmatic advertising system is likely to face increased regulatory scrutiny in the EU under the Digital Services Act and potential legislative action in the U.S. If other news organizations or civil society groups discover similar infection patterns using the published indicators, the scope of the operation may expand significantly, potentially prompting coordinated platform responses and law enforcement investigations. If Discover-Tech or related entities re-emerge under different corporate identities, as occurred with Candiru's restructuring, it would demonstrate the limitations of current industry self-regulation and likely accelerate government-led interventions in the spyware supply chain. Organizations identified in the Citizen Lab report as having Discover-Tech ad exposure should conduct retrospective log analysis for the published indicators; any confirmed infections beyond Al Jazeera would substantially elevate the incident's strategic significance.