{
  "family": "teamspy",
  "sample_count": 2,
  "category": "backdoor",
  "description": "Backdoor:Win32/Teamspy (also known as TeamSpy Crew or 'The TeamSpy Operation') is a highly sophisticated cyber-espionage toolkit (APT). Its defining characteristic is the weaponization and abuse of a legitimate, widely used remote administration tool: TeamViewer. By hijacking legitimate software (`T1219`), TeamSpy operates with extreme stealth, bypassing many heuristic and behavioral defenses because the core remote access activity looks exactly like standard IT support.<br><br><b>Understanding TeamSpy (Living off the Land)</b><br>To an end-user, the infection is completely invisible; the attackers take great pains to hide the TeamViewer interface. For a security operations center (SOC), TeamSpy is incredibly difficult to detect without deep analysis, as the network traffic is indistinguishable from authorized remote support sessions. It targets high-value individuals, industrial sectors, and government entities to steal sensitive documents, encryption keys, and proprietary data.<br><br><b>Execution and Subversion Mechanics</b><br>TeamSpy is typically deployed via highly targeted spear-phishing campaigns containing malicious attachments or links (`T1566.001`). Once initial access is gained, the malware drops a fully functional, legitimate version of TeamViewer alongside malicious, dynamically loaded libraries (DLLs). It utilizes DLL Search Order Hijacking or DLL Side-Loading (`T1574.002`) to force the legitimate TeamViewer executable to load the attacker's malicious DLL. This DLL radically alters TeamViewer's behavior: it hides the GUI, suppresses user notifications, hardcodes the access password, and configures it to run silently as a service. This grants the attacker persistent, interactive, graphical remote access (`T1059`) completely bypassing the victim's awareness.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the catastrophic, long-term theft of highly sensitive data. Host-based IoCs include EDR alerts for anomalous DLL loads into `teamviewer.exe` (specifically looking for unsigned DLLs or unexpected file paths like `%AppData%`), and the presence of suspicious configuration files (like `tv.ini` or `.cfg`) overriding default TeamViewer settings. Network IoCs are challenging, as the traffic flows to legitimate TeamViewer infrastructure, but anomalies in session duration or connections outside of normal business hours can be indicators.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1219",
    "T1574.002",
    "T1566.001",
    "T1114"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Weaponizing TeamViewer for stealthy access)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading (Forcing TeamViewer to load malicious code)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1114",
      "name": "Email Collection (A common objective for the TeamSpy operators)",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Initial access vector)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint; the attackers likely have interactive, GUI-based control of the system.",
    "If TeamViewer is not an authorized enterprise application, block its execution entirely via AppLocker and block its network ports/domains.",
    "Conduct a deep forensic review of the compromised system, specifically hunting for staged exfiltration archives (.rar, .zip).",
    "Force a password reset for all accounts accessed by the user, as TeamSpy includes comprehensive credential dumping capabilities."
  ],
  "what_to_avoid": [
    "Do not assume TeamViewer traffic is benign without verifying authorization; attackers actively use it to 'Live off the Land'.",
    "Avoid simply killing the TeamViewer process; the persistence mechanism (often a service) will restart it. Isolate the machine."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}