CONFIRMED// Citizen Lab 2026v1.0
DevilsTongue Capabilities: ATT&CK-Style Behavioral Mapping
DevilsTongue's documented capabilities organized by defensive ATT&CK-style categories — credential access, collection, persistence, defense evasion, command and control, and discovery — with evidence sources for each technique.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Credential Access
- LSASS credential accessMicrosoft 2021
- Browser-stored credentialsMicrosoft 2021
- Impersonation via stolen cookies/sessionsMicrosoft 2021
- Sending messages from logged-in accountsMicrosoft 2021
Collection
- File & document exfiltrationMicrosoft 2021
- Browser history, cookies, bookmarks & credentials (Chrome, Firefox, SQLite)Microsoft 2021
- Signal Desktop dataMicrosoft 2021
- ScreenshotsMicrosoft 2021
- KeystrokesMicrosoft 2021
- Webcam & microphone activationMicrosoft 2021
Persistence
- COM hijacking (CLSID InprocServer32 override)Microsoft 2021
- DLL drop to IMEJP path (IMJPUEXP.DLL)Microsoft 2021
- Loading via WMI service / svchost (SYSTEM)Microsoft 2021
Defense Evasion
- LoadLibraryExW return-address manipulation (stability trick)Microsoft 2021
- AES-256-CBC encrypted on-disk componentsMicrosoft 2021
- physmem.sys kernel driver for API proxyingMicrosoft 2021
- String encryption (48-byte XOR)Microsoft 2021
- Timestamp/PDB scrubbingMicrosoft 2021
- In-memory decryption & executionMicrosoft 2021
- Unique builds/hashes & PE header obfuscationMicrosoft 2021
Command and Control
- Encrypted C2 communicationCitizen Lab 2026
- Tasking & collectionMicrosoft 2021
Discovery
- Registry queriesMicrosoft 2021
- WMI queriesMicrosoft 2021
- Network connectivity checksCitizen Lab 2026
Last updated 2026-10-18 · Sources: Microsoft (2021), Citizen Lab (2026)
