Threat Actor Unknown origin

Caramel Tsunami

Also known as: SOURGUM · Candiru

Caramel Tsunami is a threat actor that specializes in spyware attacks. They have recently resurfaced with an updated toolset and zero-day exploits, targeting specific victims through watering hole attacks. Candiru has been observed exploiting vulnerabilities in popular browsers like Google Chrome and using third-party signed drivers to gain access to the Windows kernel. They have also been linked to other spyware vendors and have been associated with extensive abuses of their surveillance tools.

Indicators of Compromise 5

Domain getad[.]discover-tech[.]com Domain mtrtb[.]com Domain noas[.]discover-tech[.]com Filename DevilsTongue.dll SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8

MITRE ATT&CK TTPs 5

T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1090
Proxy
Command And Control
 T1189
Drive-by Compromise
Initial Access
 T1204.002
Malicious File
Execution

Source Articles

Targeted ads installed Candiru spyware in zero-click attacks
Candiru spyware was delivered via a zero-click attack technique dubbed AdFection, in which malicious JavaScript was embedded in targeted online advertisements served through Discover-Tech's Controlium platform. The attack targeted devices at Al Jazeera Media Network and others, with evidence showing that at least 45 devices were targeted between 2024 and 2025. The malicious ads contacted Discover-Tech's NOAS server, which selectively delivered exploit code to specific devices based on identifiers like IP address, leading to infections linked to Candiru command-and-control infrastructure. A DLL file recovered from a compromised Windows system was attributed to Candiru with high confidence.
bleeping-computer ·2w ago
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Citizen Lab identified a zero-click spyware campaign conducted by the Israeli firm Candiru, targeting Al Jazeera staff through malicious online ads served via Discover-Tech, a company posing as a legitimate digital advertising vendor. The attack exploited ad delivery infrastructure to silently deploy spyware without user interaction, with initial access established when targeted devices loaded malicious ads that triggered callbacks to attacker-controlled servers. At least 45 devices were targeted in 2024 and 2025, and the attack chain was confirmed through traffic logs and a recovered Windows malware sample linked to Candiru's known toolset.
hacker-news ·2w ago