DevilsTongueMalware
According to Microsoft, DevilsTongue is a complex modular multi-threaded piece of malware written in C and C++ with several novel capabilities. For files on disk, PDB paths and PE timestamps are scrubbed, strings and configs are encrypted, and each file has a unique hash.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“This method significantly reduces the risk of detection and failure, as it does not rely on preemptive social engineering.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ADINT: From Ad-Based Geolocation Tracking to Intrusion Vector“… developed "Sherlock", an ad-based infection vector subsequently reported by Haaretz in 2023 and identified as bundled with Candiru's DevilsTongue spyware.”
-
Predators for Hire: Commercial Surveillance Vendors Overview“DevilsTongue, Candiru’s spyware dubbed by Microsoft, also exploits 0-day vulnerabilities in various operating systems (iOS, Windows and Chrome OS).”
Indicators in its reports
named in the reports above- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.