{
  "family": "informer",
  "sample_count": 8,
  "category": "trojan",
  "description": "Spyware:Win32/Informer is a persistent, stealthy spyware and keylogger designed to breach endpoint defenses and securely collect, log, and exfiltrate highly sensitive user activity, including keystrokes, screenshots, and clipboard data, to a remote attacker.<br><br><b>Understanding Informer Spyware</b><br>To an end-user, an Informer infection is entirely invisible. The software operates deep in the background, specifically designed to hide from the Task Manager and system tray. For a security analyst, discovering Informer on a corporate endpoint indicates a critical breach of privacy and a highly likely compromise of all credentials and sensitive communications entered on that machine.<br><br><b>Execution and Surveillance Mechanics</b><br>Informer is typically installed via spearphishing (`T1566.001`) bundled with an exploit or dropped by a primary trojan. Once executed (`T1204.002`), it establishes deep persistence, often by creating a hidden Windows Service (`T1543.003`) or manipulating the Registry Run keys (`T1547.001`). Its primary function is collection: it utilizes Windows API hooks (like `SetWindowsHookEx`) to log every keystroke (`T1056.001`), takes periodic hidden screenshots of the desktop (`T1113`), and captures clipboard data (`T1115`). The harvested data is then encrypted and silently emailed to the attacker or uploaded to a remote FTP server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic loss of confidentiality and credential compromise. EDR logs are critical for detecting this threat, specifically looking for processes injecting into `explorer.exe` or hooking the keyboard APIs. Network analysts should look for unauthorized, recurring outbound SMTP (email) or FTP traffic originating from the endpoint. Host-based IoCs include the presence of hidden, encrypted log files (often with extensions like `.dat` or `.log`) buried deeply in the `%AppData%` or `%ProgramData%` directories.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1115",
    "T1048.003",
    "T1113"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1048.003",
      "name": "Exfiltration Over Alternative Protocol (Exfiltration via Email/FTP)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint to halt the exfiltration of the captured keystrokes and screenshots.",
    "Enforce a mandatory, immediate password reset for *every* account the user has accessed from that machine, prioritizing domain credentials and VPN access.",
    "Do not simply delete the executable; spyware often uses rootkit-like techniques to hide. Use an enterprise EDR solution to forcefully terminate the hooking service and clean the registry.",
    "Perform a forensic review to determine how the software was installed (checking for phishing vectors)."
  ],
  "what_to_avoid": [
    "Do not assume only the local user's data was compromised; if an administrator logged into the infected machine, their credentials were also logged.",
    "Avoid leaving the endpoint on the network while investigating, as the spyware will continue to transmit data in real-time."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}