Tracking Candiru’s DevilsTongue Spyware in Multiple Countries

Executive Summary: Recorded Future Insikt Group identified eight distinct infrastructure clusters linked to Candiru’s DevilsTongue spyware—five likely still active—detailing victim-facing and operator-tier components, cluster-specific administration differences, and a suspected corporate entity tied to a recent asset transfer; the report outlines DevilsTongue’s sophisticated Windows capabilities (user- and kernel-mode components, COM hijacking, in-memory payloads, credential and Signal data theft), documented exploitation vectors (malicious links, weaponized Office documents, watering-hole attacks and browser zero-days), observed geographic targeting and victim types, and recommended mitigations including hunting for indicators, patching, and stricter device separation.