DevilsTongue
DevilsTongue is a sophisticated, modular Windows spyware/malware associated with the Israeli spyware vendor Candiru, which Microsoft tracks as SOURGUM. Reporting describes it as part of Candiru’s commercial surveillance platform and notes infrastructure used to manage and deliver DevilsTongue across multiple operational clusters, with active clusters linked to countries including Hungary and Saudi Arabia; other reporting also linked clusters to Azerbaijan, Uzbekistan, Spain, and Indonesia. DevilsTongue includes user-mode and kernel-mode components, persistence via COM hijacking, use of the signed driver physmem.sys, and in-memory decryption/execution. Its documented capabilities include credential theft and access to Signal messages; leaked proposal material also described a licensing model based on concurrent infections and optional remote shell capability. Observed delivery and infection vectors include fake shortened URLs redirecting to exploits and the implant, single-use links, malicious Office documents, and watering-hole compromises that profiled visitors before redirecting selected targets to likely browser RCE exploit chains. Public reporting linked Candiru activity to exploitation of Chrome zero-days CVE-2021-21166 and CVE-2021-30551, Internet Explorer zero-day CVE-2021-33742, and later Chrome/WebRTC CVE-2022-2294. ESET assessed with medium confidence that operators behind certain Middle East-focused watering-hole campaigns were Candiru customers. Documented targeting and victimology in the source material include journalists, activists, civil society, diplomats, and political targets, with at least 100 victims globally reported in 2021 and later domestic surveillance reporting involving the Catalan independence movement. Mentioned infrastructure and tradecraft include victim-facing deployment/C2 systems, higher-tier operator infrastructure, intermediary layers, Tor usage in some clusters, and fake shortened URLs used to redirect targets to exploits and the DevilsTongue implant.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In July 2021, Google published a blogpost providing details on exploits used by Candiru. It includes CVE‑2021-21166 and CVE-2021-30551 for Chrome and CVE-2021-33742 for Internet Explorer. | "...fake shortened URLs redirecting to exploits and the DevilsTongue implant."
"DevilsTongue is a sophisticated, modular Windows malware." | In July 2022, Avast reported that CVE-2022-2294, a high-severity heap buffer overflow vulnerability in WebRTC within Google Chrome, was exploited to execute shellcode in the browser’s renderer process, targeting users in the Middle East.
Google’s Threat Analysis Group (TAG) disclosed in 2021 that two Google Chrome renderer remote code execution zero-day vulnerabilities (CVE-2021-21166 and CVE-2021-30551) had been exploited by Candiru... Google TAG discovered that CVE-2021-21166 also affected WebKit, prompting Apple to patch it as CVE-2021-1844; however, there is no evidence it was used against Safari users. | "DevilsTongue is a sophisticated, modular Windows malware."
Google’s Threat Analysis Group (TAG) disclosed in 2021 that two Google Chrome renderer remote code execution zero-day vulnerabilities (CVE-2021-21166 and CVE-2021-30551) had been exploited by Candiru. | "DevilsTongue is a sophisticated, modular Windows malware."
"DevilsTongue is a sophisticated, modular Windows malware."
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“… new server clusters for managing and delivering the company's DevilsTongue spyware.”
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
4 techniques
Initial Access
"...spyware can be deployed through multiple vectors, including... physical access."
As commercial spyware relies on zero-day exploits for deployment...
Execution
1 technique
Execution
"...two Google Chrome renderer remote code execution zero-day vulnerabilities (CVE-2021-21166 and CVE-2021-30551) had been exploited by Candiru..."; "...served an Internet Explorer zero-day exploit... CVE-2021-33742..."; "...CVE-2022-2294... in WebRTC within Google Chrome..."
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
3 techniques
Stealth
"...stores encrypted second-stage payloads... The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis."
Credential Access
3 techniques
Credential Access
Collection
1 technique
Collection
IOCs tracked for this family
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Spyware associated with Candiru and used for surveillance deployments, with active infrastructure clusters identified in multiple countries.
Commercial spyware (attributed here to Candiru) used to enable intrusive monitoring/surveillance, often in domestic security contexts.
Commercial spyware attributed to vendor Candiru; infrastructure used for delivery/management remains active across multiple geographies.
Windows-based mercenary spyware attributed to Candiru. Modular, multi-threaded C/C++ malware with user- and kernel-mode components; supports deep device access including file extraction, browser data collection, credential theft (including LSASS and browsers), and theft of encrypted Signal Desktop messages. Uses stealth/persistence techniques including COM hijacking (registry COM class DLL path overwrite), encrypted staged payload storage, in-memory decryption/execution, and a signed third-party driver (physmem.sys) for kernel memory access and API call proxying; also uses scrubbed metadata, encryption, and per-file unique hashes to hinder detection/analysis.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.