Here's How Citizen Lab Used Censys to Expose a Spyware Vendor

**Executive Summary:** Citizen Lab leveraged Censys datasets to map Candiru's command-and-control infrastructure and impersonated websites, recovered spyware samples, and shared IoCs with Microsoft, enabling MSTIC to identify exploitation of two privilege-escalation CVEs (CVE-2021-31979, CVE-2021-33771) and to attribute over 100 victims—predominantly activists, journalists, and human rights defenders—to Candiru's targeted spyware campaign.