Revealed: Top Secret Israeli Hackers For Hire

Candiru, named after an Amazon fish known to parasitise the human urethra, recruits heavily from 8200 intelligence unit and sells offensive tools for hacking computer systems. The name fits the company’s business, which is offensive cyber, the technology used to hack into computers or smartphones and spy on users.

In the Tel Aviv building that acts as its headquarters, Candiru name is not in the directory. Also it is not on a website as it doesn’t have one. Its 120 or so employees don’t post profiles on LinkedIn and sign strict confidentiality agreements. Inquiries by TheMarker elicited a polite but firm “no comment”.

Offensive cyber is a big business in Israel, with industry sources saying it generates about $1 billion in sales a year. The biggest and most controversial of the players is NSO, which has been cited repeatedly for selling its equipment to Arabia and Mexico that have used them to spy and crack-down on dissidents.

NSO’s specialty is hacking smartphones. Candiru’s hacking tools are used to break into computers and servers, although some sources told TheMarker that it also has technology for breaking into mobile devices as well. 

Unlike NSO, Candiru is more conservative in its choice of customers. Most of them are in Western Europe and none of them are from Africa. In fact, the company reportedly doesn’t sell equipment to Israel, although that is for business, not political, reasons, they say.

“For example, if Germany needs offensive cyber equipment for some national security matter, it will develop it in-house without question,” explained one source, who asked not to be identified. “But if it needs to contend with human trafficking from Turkey, for instance, it will buy cyber gear from an outside source where the issue is less sensitive.”

Candiru’s sales policy is an internal decision, and many Israeli companies in the business have found themselves in hot water for selling to regimes with poor records on democracy and human rights.

Israel regards offensive cyber tools as no different than other weapons and exports must be approved by the Defense Ministry. However, while the ministry is sensitive to security risks to Israel from exports, it is less concerns about democracy and human rights violations by buyers.

Candiru is also different from many other offensive cyber companies, such as hacking team and FinFisher, that only sell attack tools, because Candiru sells a complete system.

“They have a user interface through which the customer sees how many targets have been penetrated, what information has been obtained and so forth,” said one source. 

“In addition, they offer a very sophisticated service, so that if a certain attack tool doesn’t work they’ll produce a new one that will work. They sell a pre-loaded 'cartridge' of attack tools.”

Formed four years ago, Candiru is shrouded in secrecy. It is believed to employ 120 people and generate annual sales of $30 million a year, but that is only speculation by outsiders. If true, that would make it Israel’s second-largest offensive cyber company after NSO, not counting publicly traded Verint and general defense companies.

What is known is that Candiru’s founder is Isaac Zack, who was also a founder of NSO. Zack is a venture capital investor and among the founders of the investment firms Founders Group and Pico Venture Partners.

Candiru’s CEO is Eitan Achlow, who was previously an executive at the Israeli ride-sharing company Gett. But in line with Candiru’s veil of secrecy, Achlow’s LinkedIn page lists him as working in a company in stealth mode, a startup industry term for companies that haven’t launched a product and are working without publicity.

According to the Dun & Bradstreet guide, Zack is on the boards of 13 companies, among them the cybersecurity startups Cy-Ot and Orchestra, all of them in the field of protective cybersecurity. Keeping with the secrecy surrounding Candiru, its name isn’t listed among Zack’s directorships.

That is because Candiru is not the company’s registered name. It was originally registered under the name Grindavik Solutions in September 2014. It changed it to LDF Associates in March 2017 and back to Grindavik last April. 

Like other companies in Israel's renowned cybersecurity industry, Candiru recruits heavily from the Israel Defense Forces 8200 intelligence unit. They are typically paid 80,000 shekels ($21,400) a month and some make 90,000.

“They take the best hackers…,” said one cybersecurity entrepreneur, who spoke on condition of anonymity. “Candiru has no defined work conditions, you can do what you want. They even have one employee that lives in France and starts up his computer when he feels like it.”

Haaretz:      Guardian:     Computing

You Might Also Read:

Israel: The Cyber Power:

 

« Optimising Maritime Cybersecurity
Hackers Demand Ransom For Stolen 911 Documents »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CloudDNA

CloudDNA

CloudDNA deliver solutions that enable users and devices to connect over high performance, secure, efficient, scalable cloud networks.

Scale Computing

Scale Computing

Scale Computing is an industry leading application platform for EDGE computing environments covering retail, manufacturing, financial services and government.

PhishLine

PhishLine

PhishLine helps Information Security Professionals meet and overcome the increasing challenges associated with social engineering and phishing.

Celare

Celare

Celare delivers DPI based network perimeter monitoring solutions with integrated Big Data security analytics and threat detection.

Xage Security

Xage Security

Xage is the world’s first blockchain-protected security platform for Industrial IoT.

Digital Security

Digital Security

Digital Security is an Ecuadorian company specialized in providing comprehensive information security solutions.

Zighra

Zighra

Zighra is a leading provider of On-Device AI solutions for continuous authentication and fraud detection on mobile and web applications.

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference is a non-profit, annual, information security conference located in Halifax, Nova Scotia, Canada.

FortifyData

FortifyData

FortifyData is the next generation of cyber risk management–a comprehensive platform that continuously evaluates your third-party, internal and people risks.

Porto Research, Technology & Innovation Center (PORTIC)

Porto Research, Technology & Innovation Center (PORTIC)

PORTIC brings together several research centers and groups from P.PORTO in a single space, forming a superstructure dedicated to research, technology transfer, innovation and entrepreneurship.

Cyral

Cyral

Easily observe, control, and protect your data endpoints in a cloud and DevOps-first world. Discover Data Mesh Security with Cyral.

Aleo

Aleo

Aleo is building the world's leading developer platform for enabling absolute privacy on blockchains.

ViewQwest

ViewQwest

ViewQwest is a regional telecommunications & information technology services company. We specialize in providing Connectivity, Managed Network, Managed SD-WAN, and Managed Security solutions.

Goldilock

Goldilock

Goldilock is redefining how sensitive data, devices, networks and critical infrastructure can be secured.

appNovi

appNovi

appNovi inventories everything to map the attack surface, identify missing security agents, and prioritize vulnerabilities based on exposure.

DeltaSpike

DeltaSpike

DeltaSpike empowers individuals and organizations worldwide through its comprehensive cybersecurity solutions.

Zyxel Networks

Zyxel Networks

Zyxel Networks is a leading provider of secure, AI-powered networking solutions for small to medium businesses (SMBs) and the enterprise edge.