SpyGraceMalware
- SpyGlace
A backdoor, capable of providing shell access, loading additional payloads, interacting remotely with the file system and processes, and taking screenshots.From MISP Galaxy
Last reported 2 months ago, by AhnLab ASEC3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1027.007Dynamic API Resolution
“The malware’s dynamic API resolution uses an encoding scheme based on ADD and XOR.”
- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
- T1221Template Injection
“Viceroy Tiger (Donot) targeted Bangladeshi military and defense officials using remote template injection and a multi-stage shellcode loader.”
- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
July 2026 Threat Trend Report on APT Groups“Larva-25001 deployed SpyGlace through Proton Drive, malicious RAR and LNK files, and a chain involving mshta.Exe and git.Exe.”
-
Update on Attacks by Threat Group APT-C-60 in 2026“The downloader ultimately downloads and executes malware called SpyGlace from these legitimate services.”
-
Update on Attacks by Threat Group APT-C-60“Downloader2 can download and execute SpyGlace and its loader.”
Indicators in its reports
named in the reports above- protonmail[.]comin 1 report
- 31.58.136[.]207in 1 report
- 154.18.239[.]209in 1 report
- 173.234.11[.]141in 1 report
- 185.18.222[.]241in 1 report
- 213.111.158[.]200in 1 report
- 213.111.158[.]201in 1 report
- 213.111.158[.]216in 1 report
- hxxps://c.statcounter[.]com/13178005/0/7f3c2735/1/in 1 report
- hxxps://cdn.jsdelivr[.]net/gh/mei1990789/class125/in 1 report
- hxxps://github[.]com/mei1990789/class125in 1 report
- hxxps://github[.]com/sapphire679/tblsesarol/in 1 report
- hxxps://github[.]com/sapphire689/dnaluakxitin 1 report
- hxxps://github[.]com/wanib11399/zjeqopmfitin 1 report
- hxxps://github[.]com/cafes39636/ngwtaepesfin 1 report
- hxxps://github[.]com/rapefo2905/rncprjmauwin 1 report
- hxxps://github[.]com/hexif45133/yedkatinrcin 1 report
- hxxps://github[.]com/jewexo9791/archibkyofin 1 report
- hxxps://github[.]com/lowege1212/izrtyshergin 1 report
- hxxps://github[.]com/gixop88415/glfhvhtzihin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.