Caramel Tsunami
Also known as SOURGUM, Candiru
Caramel Tsunami is a threat actor that specializes in spyware attacks. They have recently resurfaced with an updated toolset and zero-day exploits, targeting specific victims through watering hole attacks. Candiru has been observed exploiting vulnerabilities in popular browsers like Google Chrome and using third-party signed drivers to gain access to the Windows kernel. They have also been linked to other spyware vendors and have been associated with extensive abuses of their surveillance tools.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- 11/12 Targeted ads delivered Candiru spyware with zero clicks. No one is deceived here, so the control sits between device and ad network. https:// secblog.reedmastodon · Oct 28, 2026
- Alleged Israeli spy company targeted Starlink usershn · Oct 27, 2026
- Interesting Git repos of the week: Detection: * https:// github.com/reversinglabs/rever singlabs-yara-rules - Reversing Labs YARA * https:// github.com/interplamastodon · Oct 25, 2026
References
- https://decoded.avast.io/threatresearch/avast-q2-2022-threat-report/
- https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/
- https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/
- https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/
- https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/
- https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.