TRACKING CANDIRU'S DEVILSTONGUE SPYWARE IN MULTIPLE COUNTRIES

Summary from the TLDR InfoSec newsletter

Insikt Group identified new infrastructure associated with the Israeli-backed Candiru spyware. Candiru developed a spyware called DevilsTongue, which is a Windows-based spyware with user and kernel-mode components that maintains persistence via COM hijacking to enable deep access to victim devices, enabling file extraction, browser data collection, and theft of encrypted messages. Insikt Group has identified five active clusters linked to infrastructure in Hungary and Saudi Arabia.