Microsoft aims to protect the world from private companies developing cyber weapons

Microsoft Corporation considers the development and sale of cyber weapons by private businesses unacceptable and promises to resist such products by all means. The company’s announcement follows the discovery of yet another malware, allegedly developed in Israel.

According to Microsoft, the weapon, developed by a group codenamed Sourgum and deactivated by Microsoft, was used for high-precision attacks that affected more than 100 people around the world – politicians, human rights defenders, journalists, scientists and embassy workers, as well as all kinds of dissidents.

To limit the impact of attacks, Microsoft has built protection against unique malware developed by Sourgum into its products, and the company has distributed protection tools to the cybersecurity communities. In addition, a Windows update was released to address the vulnerabilities that Sourgum used to implement its software. The work was carried out in close cooperation with Citizen Lab, one of the divisions of the University of Toronto.

In particular, Citizen Lab identified the group, codenamed Sourgum, as an Israeli company called Candiru, which sells malware to virtually everyone, including government agencies around the world. The latter use them to hack computers, smartphones, network infrastructure and Internet-connected devices. Microsoft investigated the software called DevilsTongue and built protection against it into antivirus products – including protection for already infected computers using Microsoft Defender and Microsoft Defender for Endpoint.

According to Microsoft, this is just a fraction of the extensive legal and technical work being done to combat threats created by private malware developers for sale. In particular, Microsoft sided with the plaintiff with its expert opinion in the course of the WhatsApp lawsuit against the NSO Group, which also developed the malicious code.

The company will continue to identify such private companies and deactivate their cyber weapons, giving unscrupulous market participants codenames for trees and other plants like Sourgum.