{
  "family": "tanspy",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nTanspy is a malicious Trojan engineered specifically to operate as an Information Stealer and Spyware. Unlike broad-spectrum botnets, Tanspy is a targeted surveillance tool. Its primary objective is to silently monitor user activity, record keystrokes, and exfiltrate sensitive data—specifically targeting login credentials, financial information, and proprietary communications.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTanspy is typically distributed via targeted spear-phishing campaigns containing weaponized attachments, or it is dropped as a secondary payload by an initial access broker who has already compromised the network perimeter.\n\nOnce executed, Tanspy employs stealthy data harvesting techniques:\n<ul>\n<li><strong>API Hooking and Keylogging:</strong> Tanspy utilizes Windows API hooking (specifically `SetWindowsHookEx`) to intercept hardware interrupts from the keyboard. It records every keystroke made by the user, storing them in hidden, encrypted log files on the local system.</li>\n<li><strong>Clipboard Monitoring:</strong> The trojan actively monitors the Windows clipboard, instantly capturing any data (like copied passwords or cryptocurrency wallet addresses) that the user copies and pastes.</li>\n<li><strong>Browser Data Extraction:</strong> It targets the credential stores of major web browsers (Chrome, Firefox) to extract saved passwords, autocomplete form data, and active session cookies.</li>\n<li><strong>Data Exfiltration:</strong> The collected data logs are periodically compressed, encrypted, and exfiltrated to the attacker's Command and Control (C2) server via SMTP (email), FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tanspy infection is a critical security incident. The immediate risk is the catastrophic compromise of user credentials. Stolen corporate VPN or RDP credentials provide the attacker with direct, authenticated access to the internal network, bypassing external firewalls and often leading to severe data breaches or ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate the compromised endpoint immediately to halt the ongoing exfiltration of keylogs and stolen credentials.</li>\n<li><strong>Global Credential Reset:</strong> It must be assumed that every password entered or stored on the infected machine is in the hands of the attacker. A mandatory, immediate reset of all associated enterprise and personal passwords is required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep API hooking techniques used by keyloggers, attempting to \"clean\" the machine is insufficient. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Tanspy",
    "Spyware.Tanspy",
    "Win32/Spy.Tanspy"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1115",
    "T1552.001",
    "T1114"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:14:42Z",
  "type": "Spyware / Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}