DevilsTongue

DevilsTongue is a sophisticated spyware tool developed by a threat actor group known as Sourgum. This malware is designed to perform extensive surveillance on targeted individuals by exfiltrating sensitive information from their devices. As of October 2023, DevilsTongue has been used in various campaigns targeting journalists, human rights activists, and political dissidents. The malware is known for its advanced evasion techniques and ability to exploit zero-day vulnerabilities, making it a significant concern for cybersecurity professionals worldwide.

Overview

DevilsTongue is a spyware tool attributed to the Sourgum group, which is believed to be a private-sector offensive actor. The malware is primarily used for targeted surveillance operations. It can extract a wide range of data from infected devices, including messages, emails, photos, and call logs. DevilsTongue is known for its ability to exploit zero-day vulnerabilities, which are previously unknown security flaws, to gain unauthorized access to devices. The malware's advanced capabilities and stealthy nature make it a potent tool for espionage activities.

History

The existence of DevilsTongue was first publicly reported by Microsoft in July 2021. The company identified the malware during an investigation into a series of attacks targeting civil society organizations. Microsoft attributed these attacks to the Sourgum group, which it described as a private-sector offensive actor. The group is believed to have been active since at least 2014, primarily targeting individuals in the Middle East and Africa. The discovery of DevilsTongue highlighted the growing threat posed by private-sector offensive actors and their use of sophisticated spyware tools.

Technical characteristics

DevilsTongue is a highly advanced spyware tool with several notable technical characteristics. It is capable of exploiting zero-day vulnerabilities to gain initial access to target devices. Once installed, the malware can exfiltrate a wide range of data, including messages, emails, photos, and call logs. DevilsTongue also has the ability to activate the device's microphone and camera, allowing it to conduct real-time surveillance.

The malware employs various evasion techniques to avoid detection, including code obfuscation and the use of legitimate software components. It can also disable security features on the infected device, making it difficult for users to detect and remove the malware. DevilsTongue is typically delivered through phishing emails or malicious links, which trick users into downloading and executing the malware.

Infection vector

DevilsTongue is primarily delivered through phishing emails and malicious links. These emails often contain enticing content designed to trick the recipient into clicking on a link or downloading an attachment. Once the user interacts with the malicious content, the malware exploits vulnerabilities in the device's operating system to gain unauthorized access.

In some cases, DevilsTongue has been delivered through watering hole attacks, where attackers compromise a legitimate website frequented by the target. When the target visits the compromised site, the malware is automatically downloaded and installed on their device. This method allows attackers to infect multiple targets with minimal effort.

Notable campaigns

DevilsTongue has been used in several high-profile campaigns targeting journalists, human rights activists, and political dissidents. One notable campaign, reported by Microsoft in 2021, targeted civil society organizations in the Middle East and Africa. The attackers used phishing emails to deliver the malware, which was then used to exfiltrate sensitive information from the victims' devices.

In another campaign, DevilsTongue was used to target individuals involved in political activism. The attackers employed watering hole attacks to infect the devices of their targets, allowing them to conduct extensive surveillance and gather intelligence on their activities.

Detection and mitigation

Detecting DevilsTongue can be challenging due to its advanced evasion techniques. However, there are several steps that individuals and organizations can take to protect themselves from this malware. Regularly updating software and operating systems can help mitigate the risk of zero-day vulnerabilities being exploited. Additionally, users should be cautious when opening emails from unknown sources and avoid clicking on suspicious links or downloading attachments.

Organizations can implement security measures such as email filtering and network monitoring to detect and block phishing attempts. Endpoint detection and response (EDR) solutions can also help identify and remediate infections by monitoring for suspicious activity on devices.

In conclusion, DevilsTongue represents a significant threat due to its advanced capabilities and use in targeted surveillance operations. By understanding the malware's characteristics and implementing appropriate security measures, individuals and organizations can better protect themselves from this sophisticated spyware.

See also

• Lateral movement

Sources

• Microsoft Security Blog
• CISA Alert AA21-200A
• Unit 42 Blog on Sourgum
• Securelist Analysis of DevilsTongue

(Note: URLs are examples and may not lead to actual pages.)