Revealed: Top Secret Israeli Hackers For Hire

Candiru, named after an Amazon fish known to parasitise the human urethra, recruits heavily from 8200 intelligence unit and sells offensive tools for hacking computer systems. The name fits the company’s business, which is offensive cyber, the technology used to hack into computers or smartphones and spy on users.

In the Tel Aviv building that acts as its headquarters, Candiru name is not in the directory. Also it is not on a website as it doesn’t have one. Its 120 or so employees don’t post profiles on LinkedIn and sign strict confidentiality agreements. Inquiries by TheMarker elicited a polite but firm “no comment”.

Offensive cyber is a big business in Israel, with industry sources saying it generates about $1 billion in sales a year. The biggest and most controversial of the players is NSO, which has been cited repeatedly for selling its equipment to Arabia and Mexico that have used them to spy and crack-down on dissidents.

NSO’s specialty is hacking smartphones. Candiru’s hacking tools are used to break into computers and servers, although some sources told TheMarker that it also has technology for breaking into mobile devices as well. 

Unlike NSO, Candiru is more conservative in its choice of customers. Most of them are in Western Europe and none of them are from Africa. In fact, the company reportedly doesn’t sell equipment to Israel, although that is for business, not political, reasons, they say.

“For example, if Germany needs offensive cyber equipment for some national security matter, it will develop it in-house without question,” explained one source, who asked not to be identified. “But if it needs to contend with human trafficking from Turkey, for instance, it will buy cyber gear from an outside source where the issue is less sensitive.”

Candiru’s sales policy is an internal decision, and many Israeli companies in the business have found themselves in hot water for selling to regimes with poor records on democracy and human rights.

Israel regards offensive cyber tools as no different than other weapons and exports must be approved by the Defense Ministry. However, while the ministry is sensitive to security risks to Israel from exports, it is less concerns about democracy and human rights violations by buyers.

Candiru is also different from many other offensive cyber companies, such as hacking team and FinFisher, that only sell attack tools, because Candiru sells a complete system.

“They have a user interface through which the customer sees how many targets have been penetrated, what information has been obtained and so forth,” said one source. 

“In addition, they offer a very sophisticated service, so that if a certain attack tool doesn’t work they’ll produce a new one that will work. They sell a pre-loaded 'cartridge' of attack tools.”

Formed four years ago, Candiru is shrouded in secrecy. It is believed to employ 120 people and generate annual sales of $30 million a year, but that is only speculation by outsiders. If true, that would make it Israel’s second-largest offensive cyber company after NSO, not counting publicly traded Verint and general defense companies.

What is known is that Candiru’s founder is Isaac Zack, who was also a founder of NSO. Zack is a venture capital investor and among the founders of the investment firms Founders Group and Pico Venture Partners.

Candiru’s CEO is Eitan Achlow, who was previously an executive at the Israeli ride-sharing company Gett. But in line with Candiru’s veil of secrecy, Achlow’s LinkedIn page lists him as working in a company in stealth mode, a startup industry term for companies that haven’t launched a product and are working without publicity.

According to the Dun & Bradstreet guide, Zack is on the boards of 13 companies, among them the cybersecurity startups Cy-Ot and Orchestra, all of them in the field of protective cybersecurity. Keeping with the secrecy surrounding Candiru, its name isn’t listed among Zack’s directorships.

That is because Candiru is not the company’s registered name. It was originally registered under the name Grindavik Solutions in September 2014. It changed it to LDF Associates in March 2017 and back to Grindavik last April. 

Like other companies in Israel's renowned cybersecurity industry, Candiru recruits heavily from the Israel Defense Forces 8200 intelligence unit. They are typically paid 80,000 shekels ($21,400) a month and some make 90,000.

“They take the best hackers…,” said one cybersecurity entrepreneur, who spoke on condition of anonymity. “Candiru has no defined work conditions, you can do what you want. They even have one employee that lives in France and starts up his computer when he feels like it.”

Haaretz:      Guardian:     Computing

You Might Also Read:

Israel: The Cyber Power:

 

« Optimising Maritime Cybersecurity
Hackers Demand Ransom For Stolen 911 Documents »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Wizard Computing

Wizard Computing

Wizard Computer Services is a full service IT solutions provider that offers managed services, consultation, installation, and support to small and large businesses in New England.

RIVA Solutions

RIVA Solutions

RIVA provides innovative best practices in IT and management consulting, program support services and emerging technologies.

Mi-Token

Mi-Token

Mi-Token is an advanced two-factor authentication solution that offers unparalleled security, flexibility, cost-effectiveness and ease of use.

CIRT.GY

CIRT.GY

CIRT-GY is the national Computer Incident Response Team for Guyana.

Maverick Technologies

Maverick Technologies

Maverick is an industrial automation, enterprise integration and operational consulting company. Services include industrial cyber security.

Baffle

Baffle

Baffle is pioneering a solution that makes data breaches irrelevant by keeping data encrypted from production through processing.

CryptoTec

CryptoTec

CryptoTec is a provider of security concepts and encryption solutions for secure communication between decentralized computerized systems.

Quest Software

Quest Software

Simple IT management for a complex world. Whether it’s digital transformation, cloud expansion, security threats or something new, Quest helps you solve complex problems with simple solutions.

Peraton

Peraton

Peraton provides innovative solutions for the most sensitive and critical programs in government today, developed and executed by scientists, engineers, and other experts.

AirEye

AirEye

AirEye is a leader in Network Airspace Protection (NAP). Block attacks against your corporate network launched from wireless devices in your corporate network airspace.

Amnesty Tech

Amnesty Tech

Amnesty Tech's Security Lab leads technical investigations into cyber-attacks against civil society and provides critical support when individuals face such attacks.

Solvere One

Solvere One

Solvere One is a managed service provider (MSP) focused on corporate consulting and partnership.

Mission Critical Partners (MCP)

Mission Critical Partners (MCP)

Mission Critical Partners is committed to delivering innovative solutions that help our clients enhance and evolve their critical-communications systems and operations.

Babble

Babble

Babble is a Unified Comms, Contact Centre and Cyber Solutions provider. We believe in making next-generation technology simple to use, deploy and manage.

The Purple Guys

The Purple Guys

The Purple Guys offer Trouble-Free IT Support to businesses across the Central and Southern US. Safe and Secure, Rapid Response, Friendly Support that’s our Purple Promise.

Digital Security Authority (DSA)

Digital Security Authority (DSA)

The establishment of the Digital Security Authority, which incorporates the National CSIRT, is crucial to significantly raising the cybersecurity posture and capabilities of Cyprus.