Uptime Hamster: 15d 10h 10mDeploy: 13 Jul 2026 08:04Updated: 2026-07-14
Logo del actor de amenaza Caramel Tsunami

Caramel Tsunami

0 incidentes 0 paises 0 sectores apt IL Ultimo: -
Aliases: Candiru, SOURGUM
Ver en IntelTracker → APTTrail →
Caramel Tsunami, also widely known as Candiru and SOURGUM, is a private Tel Aviv-based company founded in 2014 that provides spyware and cyber-espionage services exclusively to government clients. The group's business model is akin to a managed service provider for cyber-espionage, offering exploits, tools, and infrastructure to government agencies globally. They are distinguished by their exploitation of zero-day vulnerabilities across various operating systems and web browsers to deploy their persistent spyware implant, called DevilsTongue, for remote device control. The company maintains extreme secrecy, with employees bound by non-disclosure agreements, and has frequently changed its corporate name, including to Saito Tech Ltd., to evade public scrutiny. The primary motivation for Caramel Tsunami's operations is cyber-espionage, targeting sensitive information from high-intelligence-value individuals such as politicians, business leaders, human rights defenders, dissidents, journal

Aliases del actor

CandiruSOURGUM

Actores similares

Carmine Tsunamiapt · 0Denim Tsunamiapt · 0Blue Tsunamiapt · 0
Tecnicas MITRE
T1547 - Boot or Logon Autostart Execution, T1113 - Screen Capture, T1140 - Deobfuscate/Decode Files or Information, T1499, T1003 - OS Credential Dumping, T1068 - Exploitation for Privilege Escalation
Tipo
apt
Pais origen
IL
Motivacion
-
Impacto
17
Actualizado
Sat, 03 Fe

Sectores objetivo (SOCRadar)

FinanceMonetary Authorities-Central BankInsuranceBankingMotion Picture and Video Production