CONFIRMED// Citizen Lab 2026v1.0
DevilsTongue Command & Control: C2 Architecture and Infrastructure
DevilsTongue communicates with Candiru command-and-control infrastructure to receive tasking and exfiltrate collected data. The C2 layer is separated from infection infrastructure for operational security. In the 2026 AdFection case, C2 domains hard-coded in the recovered sample included fearevolve[.]com and jobmarcher[.]com.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Why C2 is separated
Spyware separates infection infrastructure (validators and exploit servers) from C2 to protect the operator's long-term access. If a validator is burned, the C2 channel to already-deployed implants remains intact.
Infrastructure layers
- • Victim-facing servers — validators and exploit servers that contact targets.
- • Operator infrastructure — C2 servers that task and receive exfiltrated data.
- • Intermediary layers — relay/proxy infrastructure, including Tor usage described by historical research.
- • Regional clusters — Recorded Future reported regional infrastructure clusters.
C2 in the AdFection case
The recovered Windows DLL hard-coded fearevolve[.]com and jobmarcher[.]com. See the IOC database for the full defensive indicator set.
Boundary: This page describes C2 conceptually for defensive understanding. It does not provide instructions for establishing clandestine C2.
Last updated 2026-10-18
