The DevilsTongue Malware Comes Out of Israel, Targets High-profile Individuals

People often imagine malware developers and users as geeky hackers sitting in dark rooms, day and night. However, would you believe it if you were told that there is another type of malware developers – who, in fact, work from a legitimate office. This is the case of Sourgum, an Israeli-based company, which is behind a piece of malware identified as DevilsTongue. Keep in mind that the odd occupation of this malware's developers is not the only surprising thing about this case – the customers are also very peculiar. Sourgum is co-operating with government agencies all over the world, and they are likely to be some of the clients of the DevilsTongue Malware.

The DevilsTongue Malware is Active in Palestine, the United Kingdom, and more...

But what is the DevilsTongue Malware and what is it used for? This is not an ordinary malware sample that will be spread to random users. In fact, barely a hundred infected systems have been identified. Some people would think that this is a small-time attack, but each one of the victims has probably been handpicked because of their role or involvement in particular industries or campaigns. A large portion of DevilsTongue Malware's victims are based in Palestine, but there are also active cases in the United Kingdom, Spain, Iran, and Israel. The victims are part of a wide range of sectors such as academics, diplomatic, media, etc.

Needless to say, the DevilsTongue Malware is a well though-out and developed project. It possesses a wide range of features, as well as the ability to identify and evade particular security tools. Its operators can use it to extract data from the compromised systems, deploy additional payloads, steal cookies, tamper with the registry, hijack passwords, and more. One of DevilsTongue Malware's interesting features is the ability to capture and decrypt conversations from Signal, a secure messaging app.

Another thing worth noting about the DevilsTongue Malware campaign is that the operators of the threat were relying on zero-day exploits in Windows products. Tracked under the aliases CVE-2021-31979 and CVE-2021-33771, the exploits have already been patched.

This high-profile malware was reported just days after the Pegasus spyware made the news yet again because of a leak containing potential targets of the NSO group.