Active infrastructure for Candiru spyware linked to Hungary, Saudi Arabia

Researchers identified eight operational infrastructure clusters associated with Candiru’s DevilsTongue spyware, a Windows-based surveillance tool. Five of these clusters are currently active, with confirmed links to Hungary and Saudi Arabia.