DevilsTongue Spyware: Global Windows-targeted Campaigns and Candiru Infrastructure

In recent years, security researchers have repeatedly cautioned that commercial surveillance tools can pose systemic risks, even as regulatory efforts attempt to curb abuse. The latest findings from Insikt Group reveal a renewed operation linked to Candiru, an Israeli spyware vendor, centered on the DevilsTongue malware family and aimed at Windows users across multiple countries. This discovery underscores how sophisticated commercial spyware continues to adapt, survive, and proliferate, exploiting complex infrastructure to evade detection and extend its reach. The DevilsTongue campaign demonstrates the ongoing threat posed by powerful surveillance products when they fall into the wrong hands or are misused by buyers with questionable intent.

What is DevilsTongue Spyware?

DevilsTongue Spyware is a modular, highly capable espionage tool associated with Candiru, a well-known vendor in the commercial surveillance market. This family is designed to operate in Windows environments, collecting a broad spectrum of data while remaining covert enough to fly under the radar of many traditional security controls. In practice, DevilsTongue behaves like a multifunctional remote access Trojan (RAT) intertwined with data exfiltration capabilities, screen capture, keystroke logging, and persistence mechanisms that help it maintain a foothold on compromised machines even after system restarts.

The latest analyses indicate that DevilsTongue is not a single monolithic binary but a platform with interchangeable modules. Each deployment can be tailored to the target’s profile, enabling operators to prioritize certain data types, such as chat messages, email content, contacts, or file collections. This modularity makes DevilsTongue adaptable to different campaigns and victim profiles, a hallmark of modern commercial spyware that targets sensitive information across borders. In 2026, researchers note an emphasis on stealth, with updates designed to minimize disk writes and to blend activity with legitimate system processes.

From an attacker’s perspective, DevilsTongue offers a combination of features that make it attractive for long-term surveillance. It can operate with minimal noticeable impact on user experience, exfiltrate data through covert channels, and rely on a resilient control architecture that can withstand some defensive efforts. For defenders, the presence of DevilsTongue signals a highly capable adversary and a reminder that commercial tools can be repurposed for targeted espionage, amplifying the importance of strong endpoint protection and careful threat monitoring.

In the broader context, DevilsTongue sits within the lineage of Candiru’s espionage offerings, which have historically included a blend of zero-day exploits, social engineering, and bespoke payloads. The DevilsTongue campaign, as observed by Insikt Group and corroborated by other researchers, showcases how such tools evolve: expanding the command-and-control (C2) footprint, refining evasion tactics, and aligning more closely with operational security practices used by human-operated intelligence campaigns.

How DevilsTongue Campaigns Operate: An End-to-End View

Understanding the lifecycle of a DevilsTongue operation reveals how attackers move from initial access to ongoing data collection while trying to stay under the radar. While specific infection vectors can vary, several consistent patterns have emerged from the investigation of Candiru-linked infrastructure and DevilsTongue payloads.

Initial Access and Delivery

Campaigns typically commence with a blend of social engineering, credential theft, or supply-chain weaknesses that deliver the DevilsTongue payload onto Windows hosts. Operators may exploit commonly exploited vectors such as phishing emails with malicious attachments or links, or leverage compromised legitimate software installers to slip the malware into target environments. In some cases, attackers attempt to entice users with credible-looking communications that prompt them to enable macros or grant elevated privileges, after which the DevilsTongue module begins to execute.

As with many espionage tool deployments, the emphasis is on convincing the end user to run the payload and provide a foothold for subsequent stages. The attackers’ choice of delivery method often depends on the target’s sector, region, and the level of scrutiny applied by local security controls. In 2026, the latest research indicates a shift toward more discreet initial access approaches, with a focus on pre-installation reconnaissance and more believable decoy content to reduce user friction.

Establishing Persistence

Once on a system, DevilsTongue seeks to establish persistence through a combination of user and kernel-level techniques. Persistence mechanisms may involve registry keys, scheduled tasks, service installations, or other startup points that ensure the malware reawakens after reboot or user logout. The exact persistence methods can be customized depending on whether the operators want long-lived access or shorter, more strategic windows of data collection. The objective is to minimize disruption while ensuring continuous data flow to the operators’ infrastructure.

Command and Control (C2) and Exfiltration

DevilsTongue communicates with its operators via a resilient C2 framework designed to evade basic network monitoring. The infrastructure often includes a mix of web-facing servers, domain names, and possibly compromised or purpose-built infrastructure that supports secure channels for data transfer. Exfiltration occurs in small, discreet chunks to avoid triggering bandwidth anomalies or anomaly detection rules. The data harvested can include documents, chat messages, emails, credentials, browser artifacts, and system telemetry that illuminate user behavior and communications patterns.

In many campaigns, the C2 architecture features redundancy and fallback channels. This design helps ensure that even if some servers are shut down or blocked, the operators retain alternate routes for controlling infected machines and receiving stolen data. The latest research points to a growing practice of rotating servers and domain addresses, complicating takedown efforts and ongoing attribution for defenders.

Lateral Movement and Coverage

Beyond the initial host, DevilsTongue operators may attempt limited lateral movement to adjacent devices within a network, especially if those devices contain valuable data or access to additional credentials. While not every infection will attempt internal spread, the capability exists to broaden the surveillance net when opportunities arise. This aspect of the campaign enhances the overall value of the intrusion by widening the potential data surface and increasing the likelihood of capturing cross-device information.

Crucially, DevilsTongue remains focused on stealth. By blending processes with legitimate system activity, and by controlling the timing and volume of data exfiltration, the attackers aim to minimize user suspicion and avoid triggering common security alerts. The 2026 view emphasizes a sophisticated balance between data collection pace and operational security, which is consistent with the reputation of Candiru’s tooling as a premium surveillance product.

Update Cycles and Evolving Capabilities

Modern DevilsTongue deployments feature modular updates that can be deployed without a full reinstall. These updates may add new data collection modules, adjust C2 behavior, or refine evasion techniques. The latest research indicates that operators frequently rotate or refresh components to align with new target environments and to bypass newly implemented protections. This approach also complicates reverse engineering efforts, as defenders must repeatedly analyze evolving payloads rather than a single static sample.

From a defense perspective, it’s essential to monitor for patterns such as unusual, persistent power usage, frequent DNS lookups to unfamiliar domains, sudden spikes in outbound data, or processes that exhibit anomalous CPU or memory behavior during idle periods. These indicators can point to a DevilsTongue infection even when explicit IOCs are not yet identified.

Candiru Infrastructure: The Underlying Network That Powers DevilsTongue

The infrastructure supporting DevilsTongue campaigns is a critical piece of the puzzle. Research from Insikt Group and other security outfits points to a set of interconnected servers, domains, and network configurations that appear across multiple operational clusters tied to Candiru. This infrastructure is designed to support robust command and control, flexible deployment of payload modules, and resilient data exfiltration channels that can survive targeted takedowns and network-level disruptions.

Key characteristics of the Candiru infrastructure observed in relation to DevilsTongue include:

• Redundant C2 paths: Operators deploy multiple C2 endpoints to ensure continued access even if some nodes are blocked or shut down.
• Dynamic domain usage: Domain names and hosting addresses rotate regularly to avoid easy correlation and takedown efforts.
• Stealthy network behavior: Communications may utilize encrypted channels, mimic legitimate software traffic, or blend with normal enterprise network activity.
• Module-specific servers: Some servers are dedicated to particular DevilsTongue modules, facilitating rapid updates and targeted data handling.
• Cross-region footprint: The infrastructure spans multiple geographic regions, reflecting the global scope of Candiru’s operations and the campaigns they support.

In practical terms, this means defenders face a moving target. Blocking a single server or domain is unlikely to disrupt the campaign entirely, as operators can switch to alternative routes. The presence of interconnected clusters implies that attribution remains challenging, and takedown operations must be coordinated across multiple jurisdictions and infrastructure layers. The evolving nature of the Candiru network highlights the importance of comprehensive monitoring, proactive threat hunting, and international collaboration among security teams and policymakers.

The latest analyses also stress that DevilsTongue’s infrastructure is not static. The ongoing expansion and tightening of the network’s security posture indicate that Candiru is continuing to invest in a more resilient, harder-to-disrupt environment. For defenders, the takeaway is clear: prioritize behavioral detection, network anomaly monitoring, and rapid response capabilities that can adapt to changing infrastructure layouts rather than relying solely on static indicators.

Target Profile and Geographic Reach: Who Is at Risk?

Evidence collected from related campaigns shows that DevilsTongue’s victims span a range of sectors and regions. While exact lists of affected organizations are not always disclosed, the observed patterns suggest targeted individuals and organizations that may have access to valuable information or strategic communications. The user base for Candiru’s surveillance tools has historically included government-associated actors, journalists, researchers, and professionals in politically sensitive or high-value sectors. The DevilsTongue campaign appears to align with similar patterns, choosing targets where data exfiltration can yield meaningful intelligence or leverage for influence.

Geographically, the campaigns associated with Candiru and DevilsTongue have been described as global in scope. Investigations note activity across multiple countries in different regions, underscoring the tool’s versatility and the attackers’ willingness to operate beyond traditional strongholds. The distributed nature of the infrastructure further supports the conclusion that these campaigns are not confined to a single locale but rather reflect a multinational, multi-sector threat landscape.

From a risk management perspective, organizations should assume that Windows endpoints across diverse regions could be potential targets. The risk model should therefore emphasize robust endpoint protection, stringent access controls, and continuous monitoring for signs of covert data collection. For individuals, the primary protective measures are education about phishing, careful handling of attachments or links, and an emphasis on safeguarding credentials and sensitive information. In 2026, with the continued evolution of commercial spyware, the importance of diligent user awareness and strong technical controls remains paramount.

Defensive Posture: Mitigations, Detections, and Best Practices

Defending against DevilsTongue and similar tools requires a multi-layered approach that combines technology, processes, and human vigilance. Below is a structured playbook designed to help organizations reduce risk, detect intrusions early, and minimize potential data loss. The recommendations reflect current best practices and are aligned with the evolving capabilities observed in Candiru’s campaigns.

Technical Controls

Implement a defense-in-depth strategy that emphasizes the following:

• Patch and configuration hardening: Keep Windows systems updated with the latest security patches. Apply security baselines that restrict unnecessary services and disable risky features by default, such as macro execution in Office applications and optional LSA policy changes that could facilitate credential theft.
• Application control and privilege hygiene: Enforce strict application allowlists and principle of least privilege. Limit administrative rights and segregate duties to minimize the potential impact of a compromised account.
• Endpoint detection and response (EDR): Deploy EDR solutions capable of detecting unusual process behavior, persistence techniques, and data exfiltration patterns typical of spyware toolchains. Ensure EDR telemetry is collected and analyzed regularly.
• Network segmentation and monitoring: Segment critical networks, monitor outbound traffic for abnormal data flows, and inspect untrusted traffic streams. Implement DNS filtering and reputation-based controls to block known malicious domains related to Candiru infrastructure.
• Data loss prevention (DLP): Deploy DLP policies that monitor for sensitive data exfiltration, especially from endpoints used by high-value personnel. Configure alerting on anomalous data transfers.
• Secure configurations and hardening: Enforce strong credential practices, enable MFA across all remote access points, and disable legacy protocols that can be abused by attackers.

Threat Detection and Hunting

Active threat hunting should focus on identifying DevilsTongue’s behavioral patterns, not just static IOCs. Techniques include:

• Behavioral indicators: Unusual persistence mechanisms, abnormal process trees, or processes that inject into legitimate system processes.
• Network indicators: Covert C2 traffic, encrypted or obfuscated communications, and irregular DNS lookups to domains associated with Candiru infrastructure.
• Data exfiltration signals: Sudden bursts of outbound data, especially involving document types commonly targeted by espionage campaigns, with timing that aligns to user activity patterns.
• Endpoint telemetry correlation: Correlate events across endpoints to detect multi-host infections or shared infrastructure footprints that point to DevilsTongue activity.

User Education and Awareness

Many campaigns rely on user interaction to install the payload. Strengthen user resilience through:

• Phishing simulations: Regular training and simulated phishing exercises to reduce susceptibility to social engineering acts used in initial access.
• Security-aware culture: Promote best practices for handling attachments, links, and credential usage. Encourage reporting of suspicious activity and near-miss events.
• Macro hygiene: Disable or tightly control macro functionality in office documents and use protected view features where appropriate.

Incident Response and Recovery

Prepare for fast containment and recovery with a well-defined IR plan:

1. Containment: Isolate affected endpoints and revoke compromised credentials promptly.
2. Eradication: Remove DevilsTongue components, clean affected systems, and restore from trusted backups if necessary.
3. Recovery: Validate system integrity, re-enroll devices into security monitoring, and reissue credentials with enhanced protections.

Indicators of Compromise (IOCs) and Detection Mindset

While IOCs evolve, certain classes of signals tend to persist across campaigns:

• Unusual persistence artifacts and startup entries that survive reboots
• Uncharacteristic data flows to unfamiliar domains or servers
• Unexpected process behaviors, especially those that mirror legitimate system processes
• Indicators tied to Candiru-linked infrastructure, including known overlapping server names, IPs, or domain patterns observed in threat intel reports

Security teams should maintain a living watchlist of related artifacts and update it as new information becomes publicly available. Collaboration with industry information-sharing platforms enhances the probability of early detection and collective defense against such campaigns.

Temporal Context and Emerging Trends

The security landscape around commercial spyware is fluid. In 2026, the latest research indicates several notable trends that shape how defenders prepare and respond:

• Increased sophistication of evasion: Attackers refine their use of legitimate processes and legitimate-looking software signals to obscure malicious activity.
• Dynamic infrastructure: The Candiru network shows rapid domain and server rotation, complicating takedown efforts and highlighting the need for long-term, behavior-based detections.
• Cross-border operations: The global reach of DevilsTongue campaigns underscores the importance of international cooperation in attribution, policy response, and incident response.
• Focus on high-value targets: Campaigns appear increasingly tailored to individuals and organizations with access to sensitive information, emphasizing the need for targeted defense in addition to broad protections.

The latest research indicates that defenders must treat commercial surveillance tools as a persistent, adaptable threat rather than a one-off incident. For organizations that rely on Windows endpoints, implementing layered defenses, strong governance, and responsive incident management remains essential to reducing risk and minimizing the potential impact of such campaigns.

Multiple Perspectives: Advantages, Disadvantages, and Alternatives

Analyzing DevilsTongue and Candiru through different lenses helps stakeholders understand why these tools persist and how to respond effectively. Here are several viewpoints to consider:

From the Attacker’s Perspective

Advantages: Access to comprehensive data with relatively stealthy operation, modular payloads that can be customized to each target, and a sophisticated infrastructure that supports resilience and persistence. The ability to tailor data collection to specific victims increases the value proposition of commercial spyware for surveillance purposes.

Disadvantages: The legal and reputational risks are significant for vendors and operators. Even if publicly marketed as enterprise-grade products, misuse can attract regulatory scrutiny, sanctions, and aggressive enforcement actions. Operational complexity can also lead to exposure if security teams successfully detect and disrupt networks.

From the Defender’s Perspective

Advantages: Understanding a known toolset provides actionable indicators of compromise, enabling more precise threat hunting and more effective deterrence. The use of credible threat intelligence helps tailor defensive controls and incident response playbooks to real-world adversaries.

Disadvantages: The evolving, modular nature of DevilsTongue makes detection challenging. A focus on IOCs alone can be insufficient, as attackers rotate components and infrastructure. This reality underscores the need for dynamic defense strategies that prioritize behavior and network analytics over static signatures.

From the Policy and Public Safety Perspective

Advantages: The existence of regulated, commercially sold surveillance tools raises the possibility of controlled use in lawful, protective contexts where appropriate oversight is in place. Clear export controls and accountability mechanisms can help prevent abuse and protect civil liberties.

Disadvantages: Striking the right balance between legitimate use and misuse is complex. Overly restrictive policies could hamper legitimate security research and defensive innovation, while lax regulations may enable more aggressive abuses of surveillance technologies.

Practical Guidance for Organizations and Individuals

Whether you’re an IT security leader, a researcher, or an individual user, practical steps can reduce exposure to DevilsTongue and related threats. The recommendations below summarize concrete actions that align with current best practices.

For Organizations

1. Adopt a defense-in-depth posture: Combine endpoint protection, network controls, identity protections, and security awareness training to create multiple layers of defense.
2. Regularly update and harden endpoints: Patch Windows systems promptly and enforce security baselines to minimize exploitable configurations.
3. Enforce least privilege and MFA: Limit admin access and require multi-factor authentication for all critical platforms, including remote access gateways.
4. Monitor for behavioral anomalies: Use EDR and SIEM correlations to detect unusual persistence techniques, data exfiltration patterns, and C2-like activity.
5. Implement robust email and web protection: Filter phishing attempts and suspicious attachments, and restrict risky web content that could host drive-by downloads or malicious payloads.
6. Prepare an incident response plan: Define roles, playbooks, and communication channels to ensure quick containment and recovery when a compromise is detected.

For Individuals

1. Be cautious with emails and attachments: Do not open files or click links from unknown senders, and verify sender identities through independent channels when possible.
2. Protect credentials: Use unique, strong passwords and enable MFA for all critical accounts. Be wary of credential phishing attempts.
3. Keep software up to date: Regularly install updates for Windows, browsers, and productivity tools to close known vulnerabilities.
4. Limit data exposure: Be mindful of the data you share in communications and cloud services, and review app permissions that access sensitive information.
5. Use secure configurations: Enable security features in your operating system and applications, and disable unnecessary features that could be exploited by spyware tools.

For Researchers and Analysts

• Share findings responsibly: Contribute to threat intel platforms to help others recognize and defend against DevilsTongue and Candiru-related activity.
• Focus on behavioral detections: Develop detection models that identify persistence, C2 communications, and exfiltration patterns rather than relying solely on IOCs.
• Coordinate with policymakers: Provide insights that inform regulatory discussions about the legitimate use and controls for commercial surveillance tools.

FAQ: Common Questions About DevilsTongue Spyware and Candiru Infrastructure

Q: What exactly is DevilsTongue spyware? A: DevilsTongue is a modular espionage tool linked to Candiru that targets Windows systems. It combines data collection capabilities with persistence and covert communication to enable long-term surveillance while evading typical security controls.

Q: Who uses Candiru’s tools? A: Candiru’s offerings are marketed to customers seeking advanced surveillance capabilities. While intended for legitimate purposes, there have been cases where these tools were used for unauthorized or questionable activities, raising concerns about abuse and accountability.

Q: How can organizations protect themselves against DevilsTongue? A: Protecting against DevilsTongue involves a layered approach: keep systems updated, enforce least privilege and MFA, deploy robust EDR/SIEM, monitor for anomalous persistence and C2-like traffic, educate users, and have a tested incident response plan in place.

Q: What makes Candiru infrastructure challenging to disrupt? A: The network’s redundancy, domain rotation, and cross-regional footprint create resilience against takedowns. Disrupting it often requires coordinated efforts across multiple jurisdictions and strong threat intelligence collaboration.

Q: What should organizations do now to prepare for 2026 and beyond? A: Prioritize behavioral detection, adopt proactive threat hunting, and maintain cross-functional resilience measures. Emphasize rapid patching, strict access controls, and continuous user education to minimize risk from sophisticated spyware campaigns.

Q: Are there legitimate uses for commercial surveillance tools? A: Yes, in some cases, legitimate law enforcement and cybersecurity operations may benefit from advanced tools. However, stringent oversight, clear legal frameworks, and robust safeguards are essential to prevent abuse and protect civil liberties.

Conclusion: Staying Ahead in a Evolving Threat Landscape

The DevilsTongue campaign, connected to Candiru’s infrastructure, illustrates a persistent reality: commercial spyware remains a potent instrument for targeted surveillance, capable of operating across borders and evolving to counter defenses. For Windows users, organizations, and researchers alike, this underscores the need for continuous vigilance, strategic investments in defense, and cooperative efforts to curb abuse while preserving legitimate security capabilities. In 2026 and beyond, the most effective protection will rest on combining advanced technology with disciplined processes, informed governance, and proactive threat intelligence that keeps pace with a threat landscape that refuses to stand still.