Canadian group helps Microsoft identify vulnerabilities used in spyware

A Canadian university digital security rights group has helped Microsoft identify and patch two Windows vulnerabilities it says were used by an Israeli-based software company that sells spyware to governments.

The University of Toronto’s Citizen Lab said this week the privilege escalation vulnerabilities were exploited by Saito Tech Ltd., more commonly known as Candiru. Microsoft patched both vulnerabilities as part of its July Patch Tuesday releases.

With the help of a U.S. based threat intelligence company called Team Cymru and others, Citizen Lab said found “a politically active victim” in Western Europe and recovered a copy of Candiru’s Windows application. Working with Microsoft’s Threat Intelligence Center (MSTIC) researchers discovered the CVE-2021-31979 and CVE-2021-33771 vulnerabilities.

In its account of the work, Microsoft dubs the company ‘Sourgum.’  Its research shows the malware — which Microsoft calls ‘DevilsTongue’ — allegedly sold by the firm targeted more than 100 victims around the world including politicians, human rights activists, journalists, academics, embassy workers, and political dissidents. Approximately half of the victims were found in the territory of the Palestinian Authority, with most of the remaining victims located in Israel, Iran, Lebanon, Yemen, Spain (specifically Catalonia), the United Kingdom, Turkey, Armenia, and Singapore.

Citizen Lab said that by scanning the internet it identified more than 750 websites linked to infrastructure supporting the spyware. It found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter movement, as well as media companies, and other civil-society themed entities.

The attacker appears to use a chain of browser and Windows exploits, Microsoft said, including 0-days, to install the DevilsTongue malware on victim boxes. Browser exploits appear to be served via single-use URLs sent to targets on messaging applications such as WhatsApp.

DevilsTongue is a complex modular multi-threaded piece of malware written in C and C++ with what Microsoft says are several novel capabilities. Briefly, it can collect files, query the Windows registry, run WMI commands and query SQLite databases. It’s capable of stealing victim credentials from both Windows’ LSASS (Local Security Authority Subsystem Service) and from browsers. It also has dedicated functionality to decrypt and exfiltrate conversations from victim computers through the Signal messaging app.

It also seems able to use cookies directly from the victim’s computer on websites such as Facebook, Twitter, Gmail, Yahoo,, Odnoklassniki, and Vkontakte to collect information, read the victim’s messages, and retrieve photos, Microsoft said. DevilsTongue can also send messages as the victim on some of these websites, appearing to any recipient that the victim had sent these messages. The capability to send messages could be weaponized to send malicious links to more victims.

This is the latest in a number of investigations by Citizen Lab into what it calls spyware or questionable applications sold to governments for surveillance of citizens. Two years ago its researchers were targets of suspicious people.

The apparent widespread use of Candiru’s infrastructure and the use of its surveillance technology against global civil society, “is a potent reminder that the mercenary spyware industry contains many players and is prone to widespread abuse,” says the Citizen Lab report.

“This case demonstrates, yet again, that in the absence of any international safeguards or strong government export controls, spyware vendors will sell to government clients who will routinely abuse their services. Many governments that are eager to acquire sophisticated surveillance technologies lack robust safeguards over their domestic and foreign security agencies. Many are characterized by poor human rights track records. It is not surprising that, in the absence of strong legal restraints, these types of government clients will misuse spyware services to track journalists, political opposition, human rights defenders, and other members of global civil society.”

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

ADaPT connects employers with highly skilled young workers

Help wanted. That’s what many tech companies across Canada are saying, and research shows...

Unlocking Transformation: IoT and Generative AI Powered by Cloud

Amidst economic fluctuations and disruptive forces, Canadian businesses are steering through uncharted waters. To...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now