{
  "family": "tspy",
  "sample_count": 22,
  "category": "ransomware",
  "description": "Spyware:Win32/Tspy is a broad heuristic classification for trojans specifically designed to covertly monitor user activity, log keystrokes, capture screen data, and steal sensitive credentials, transmitting this intelligence back to the attacker.<br><br><b>Understanding Tspy</b><br>To the victim, a Tspy infection is completely invisible, designed to operate silently in the background while the user interacts with their system. For threat intelligence analysts, a Tspy detection is a critical breach of confidentiality. Unlike ransomware which announces its presence, spyware aims for long-term intelligence gathering, often serving as the initial phase of a larger targeted attack (spearphishing or corporate espionage).<br><br><b>Execution and Data Harvesting</b><br>Tspy variants are typically delivered via malicious email attachments (`T1566.001`) or as secondary payloads dropped by exploit kits. Upon execution, the malware establishes persistence (usually via Registry Run keys) and injects its core monitoring DLLs into the Windows Explorer process (`explorer.exe`) or web browsers. It actively hooks the Windows API (`SetWindowsHookEx`) to intercept every keystroke (`T1056.001`), capturing passwords as they are typed. Advanced variants also utilize the clipboard API (`T1115`) to steal copied data and take periodic screenshots (`T1113`) of active windows.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic compromise of credentials and sensitive corporate data. EDR platforms must alert on unauthorized API hooking or the presence of anomalous hidden files storing raw keystroke logs (often stored locally before exfiltration). Network logs will show periodic, encrypted outbound traffic to C2 servers containing the stolen data. The presence of unknown, hidden scheduled tasks or registry keys pointing to executable files in `%AppData%` is a strong IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1113",
    "T1115",
    "T1048",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the exfiltration of the captured keystrokes and screenshots.",
    "Initiate a mandatory password reset for all accounts (local, domain, and web services) that were accessed from the infected machine.",
    "Capture a forensic memory image to extract the malware's configuration and identify the C2 drop server.",
    "Review firewall and proxy logs to determine the volume of data exfiltrated and identify the destination IP addresses."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any administrative portals or sensitive applications from the infected machine before it is completely wiped.",
    "Avoid simply deleting the malware executable; assume all credentials stored on or typed into the machine have been compromised."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}