Windows spyware tracked as DevilsTongue — a product of the company Candiru — is likely still active, with clusters appearing in Hungary and Saudi Arabia, researchers said.

A DevilsTongue Windows-alapú szoftver kormányzati ügyfeleknek értékesít.

Cybersecurity experts have discovered a new infrastructure suspected to be used by spyware company Candiru to target computers via Windows malware. DevilsTongue spyware targets Windows systems The research by Recorded Future’s Insikt Group disclosed eight different operational clusters associated with the spyware, which is termed as DevilsTongue. Five are highly active, including clusters linked to Hungary and Saudi Arabia.  About Candiru’ spyware According to the report, the “infrastructure includes both victim-facing components likely used in the deployment and [command and control] of Candiru’s DevilsTongue spyware, and higher-tier infrastructure used by the spyware operators.” While a few clusters directly handle their victim-facing infrastructure, others follow an intermediary infrastructure layers approach or through the Tor network, which allows threat actors to use the dark web. Additionally, experts discovered another cluster linked to Indonesia that seemed to be active until November 2024. Experts couldn’t assess whether the two extra clusters linked with Azerbaijan are still active. Mode of operation Mercenary spyware such as DevilsTongue is infamous worldwide, known for use in serious crimes and counterterrorism operations. However, it also poses various legal, privacy, and safety risks to targets, their companies, and even the reporter, according to Recorded Future. Windows itself has termed the spyware Devil's Tongue. There is not much reporting on its deployment techniques, but the leaked materials suggest it can be delivered via malicious links, man-in-the-middle attacks, physical access to a Windows device, and weaponized files. DevilsTongue has been installed via both threat actor-controlled URLs that are found in spearphishing emails and via strategic website attacks known as ‘watering hole,’ which exploit bugs in the web browser. Insikt Group has also found a new agent inside Candiru’s network that is suspected to have been released during the time when Candiru’s assets were acquired by Integrity Partners, a US-based investment fund. Experts believe that a different company might have been involved in the acquisition. How to stay safe? In the short term, experts from Recorded Future advise defenders to “implement security best practices, including regular software updates, hunting for known indicators, pre-travel security briefings, and strict separation of personal and corporate devices.” In the long term, organizations are advised to invest in robust risk assessments to create effective policies.

The emergence of DevilsTongue marks a significant escalation in mercenary spyware capabilities, leveraging advanced Windows-based techniques to infiltrate high-value targets worldwide. First observed in campaigns dating back to 2019, this modular malware aggressively exploits zero-day browser vulnerabilities and weaponized documents to gain initial access. Once deployed, it establishes a stealthy presence, exfiltrating sensitive data from corporate and personal environments alike. Recorded Future researchers identified new victim-facing and operator-tier infrastructure in multiple countries, underscoring both the global scale of operations and the diversity of administrative practices across clusters. DevilsTongue’s attack vectors include spearphishing with malicious links, strategic watering hole compromises, and booby-trapped Office documents. Google’s Threat Analysis Group observed exploits targeting Chrome and Internet Explorer in 2021, specifically CVE-2021-21166 and CVE-2021-33742, delivering DevilsTongue payloads via single-use URLs and embedded ActiveX objects. Following initial compromise, the malware leverages a signed driver (physmem.sys) to achieve kernel-level memory access, enabling advanced in-memory payload execution without writing to disk. Recorded Future analysts noted that these techniques allow DevilsTongue to evade traditional signature-based detection, maintaining under-the-radar persistence on victim devices. The global impact of DevilsTongue has been profound. Government clients across Europe, the Middle East, and Asia have deployed the spyware against politicians, journalists, and dissidents. Citizen Lab and Microsoft reported over 100 victims spanning Palestine, Türkiye, and Spain, among others. Targeting infrastructure has been traced to entities in Saudi Arabia, Hungary, and Indonesia, with some clusters still active as of mid-2025. Timeline of Candiru’s corporate registrations (Source – Recorded Future) The high cost of deployment—estimated at millions of euros—limits usage to high-value targets, yet the consequences for personal privacy and national security are indisputable. Timeline of Candiru targeting (Source – Recorded Future) Among the distinguishing features of DevilsTongue is its sophisticated persistence mechanism. Upon execution, the first-stage DLL is dropped into the system directory and a legitimate COM class registry key is hijacked to load this malicious library. The malware reinjects the original COM DLL to preserve system stability, while its own code runs covertly in memory. Persistence is further bolstered by encrypted configuration storage and dynamic hashing of payload components, impeding forensic analysis. Infection Mechanism DevilsTongue’s infection mechanism centers on multi-stage exploitation and stealthy payload delivery. Initially, a tailored phishing email directs the target to a malicious domain impersonating legitimate services. A browser exploit chain triggers remote code execution , dropping a loader that retrieves an encrypted second-stage payload. Candiru pricing options (Source – Recorded Future) This loader employs a signed driver, physmem.sys, to map the payload into memory with kernel privileges. The code snippet below illustrates how the malware hijacks a COM class registry entry to achieve persistence:- // COM hijacking registry modification HKEY hKey; RegOpenKeyExW(HKEY_CLASSES_ROOT, L"CLSID\\{00000000-0000-0000-C000-000000000046}\\InprocServer32", 0, KEY_SET_VALUE, &hKey); RegSetValueExW(hKey, NULL, 0, REG_SZ, (BYTE*)L"C:\\Windows\\system32\\IME\\stage1.dll", sizeof(L"C:\\Windows\\system32\\IME\\stage1.dll")); RegCloseKey(hKey); This tactic ensures that whenever the COM class is instantiated by a legitimate application, the malicious DLL is loaded first, granting DevilsTongue full control. Subsequent modules decrypt and execute only in memory, leaving minimal forensic artifacts on disk. Such layered execution highlights the depth of sophistication in DevilsTongue’s design and its continued evolution against modern defenses. Equip your SOC with full access to the latest threat data from  ANY.RUN TI Lookup  that can Improve incident response ->  Get 14-day Free Trial The post Sophisticated DevilsTongue Windows Spyware Tracking Users Globally appeared first on Cyber Security News .

Windows spyware tracked as DevilsTongue — a product of the company Candiru — is likely still active, with clusters appearing in Hungary and Saudi Arabia, researchers said.

Windows spyware tracked as DevilsTongue — a product of the company Candiru — is likely still active, with clusters appearing in Hungary and Saudi Arabia, researchers said.

Tracking Candiru’s DevilsTongue Spyware in Multiple Countries

Cybersecurity researchers have unveiled alarming new details about Candiru, the Israeli spyware company now operating as Saito Tech Ltd., revealing an expansive network of surveillance operations targeting individuals worldwide. At the heart of these operations is DevilsTongue, a sophisticated Windows-based spyware capable of infiltrating personal and corporate systems, collecting sensitive data, and remaining virtually undetectable. The revelations highlight ongoing risks posed by mercenary spyware firms and their global clients, from governments to intelligence agencies.

Windows spyware tracked as DevilsTongue — a product of the company Candiru — is likely still active, with clusters appearing in Hungary and Saudi Arabia, researchers said.

Windows spyware tracked as DevilsTongue — a product of the company Candiru — is likely still active, with clusters appearing in Hungary and Saudi Arabia, researchers said.

Az izraeli DevilsTongue teljes távoli hozzáférést ad a támadónak. The post Egy nemzetközi kiberbiztonsági jelentés szerint Magyarország is szerepel a világ egyik legfejlettebb kémprogramjának aktív felhasználói között first appeared on 24.hu.