VERY IMPORTANT

The report details the activities of Candiru, an Israeli spyware vendor, and its DevilsTongue malware. Eight infrastructure clusters were identified, with five likely active, including those linked to Hungary and Saudi Arabia. DevilsTongue is a sophisticated Windows spyware used for surveillance. The company has faced regulatory challenges but remains resilient. The mercenary spyware market is growing, extending risks beyond civil society. Effective mitigation requires continuous monitoring, risk assessment, and stronger regulations. The report also covers Candiru's corporate history, licensing model, and infection vectors, including zero-day exploits and strategic website compromises.