{
  "family": "spyagent",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Spyware:Win32/Spyagent is a highly prevalent malware family (and sometimes a commercial 'employee monitoring' tool abused by attackers) designed to comprehensively monitor and record a user's activity. Its primary goal is absolute stealth, operating invisibly to capture keystrokes, take screenshots, record application usage, and steal credentials, subsequently exfiltrating this data to a remote attacker.<br><br><b>Understanding Spyagent</b><br>To an end-user, a Spyagent infection is entirely invisible. The system runs normally, with no ransom notes or visible windows. For an enterprise security team, Spyagent represents a critical, ongoing breach of confidentiality. Because it can be compiled from commercial 'stalkerware' sources, it is often used in targeted corporate espionage or by malicious insiders.<br><br><b>Execution and Surveillance Mechanics</b><br>Spyagent is typically delivered via spearphishing attachments (`T1566.001`) or installed physically by a malicious insider (`T1091`). Upon execution, it establishes deep persistence, often running as a hidden Windows Service (`T1543.003`) or creating heavily obfuscated Registry Run keys (`T1547.001`). Once active, Spyagent hooks the `SetWindowsHookEx` API to capture every keystroke typed (`T1056.001`). It regularly queries the `GetForegroundWindow` API to log which applications are in focus, taking periodic screenshots (`T1113`). It may also scrape the clipboard (`T1115`) and extract saved passwords from browsers (`T1555.003`). The massive volume of harvested data is encrypted, compressed into archive files (e.g., `.zip` or `.cab`), and exfiltrated via FTP, SMTP, or HTTP (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, prolonged data loss, including intellectual property, passwords, and sensitive communications. Host-based IoCs include EDR alerts for extensive API hooking, the presence of hidden, growing log files (often encrypted) in the `%AppData%` or `%Temp%` directories, and unknown processes running as a Service. Network IoCs include regular, scheduled outbound connections (e.g., every 60 minutes) to unknown FTP servers or SMTP relays to deliver the logs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1113",
    "T1048",
    "T1543.003",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol (FTP/SMTP)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network to halt the exfiltration of the recorded logs.",
    "Assume all credentials, emails, and sensitive documents accessed on the compromised machine have been stolen. Initiate an enterprise-wide password reset for the affected user.",
    "Preserve the system state (RAM dump) to analyze the running spyware process and locate the local staging directory where it stores its encrypted logs before exfiltration.",
    "Review firewall and proxy logs to identify the external FTP/SMTP servers used for exfiltration and block them."
  ],
  "what_to_avoid": [
    "Do not allow the user to change their passwords *from the infected machine*; the spyware will simply record the new credentials.",
    "Avoid closing the incident simply by deleting the executable; ensure a full investigation determines exactly what data was lost."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}