Threat Intelligence / Actor / Saito Tech (Candiru)

Saito Tech (Candiru)

Nation: Israel · 1 tracked threat(s) · Categories: VULNERABILITY

Also known as: Candiru, Candiru Ltd., Saito Tech Ltd., Sourgum, Taveta Ltd., Grindavik Solutions, DF Associates

Tracked threats

Android Exploit Chain — Saito Tech Commercial Spyware: ART Runtime RCE, Binder UAF LPE, Pixel Bootloader Persistence (CVE-2026-22104, CVE-2026-22107, CVE-2026-22112) — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence