TeamSpyMalware
- teamviewerent
- TVRAT
- TVSPY
Last reported 3 days ago, by The Hacker News3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1199Trusted Relationship
“"The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions," Solar said.”
- T1543.003Windows Service
“The primary responsibility of the Windows service is to launch the rogue binary "C:\Program Files\VMware\VMware Tools\authd.exe" that, besides launching a GOST tunnel every Saturday from 10 p.m.”
- T1684Social Engineering
“Phantom Deal profile: Gen Digital has stumbled upon a cybercrime group that poses as executives who use WhatsApp social-engineering to trick victims into investing or acquiring fake companies.”
- T1685.005Clear Windows Event Logs
“…tor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion“… websites and online platforms, while identifying possible overlaps between the botnet infrastructure and historical activity linked to TeamSpy, a threat cluster known for abusing TeamViewer to facilitate reconnaissance and data theft.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“The messages contained malicious Excel files that deployed the TVSPY and DarkVNC malware on job seekers' devices.”
-
Russian Man Extradited Over Malware Campaign Targeting Freelancers“A variant of TVRAT, or TeamViewer Remote Access Trojan, also known as TVSPY or TeamSpy, exploited a vulnerability in TeamViewer to give remote control of infected computers, while DarkVNC had similar functionality through VNC Viewer.”
Indicators in its reports
named in the reports above- idscan[.]netin 1 report
- crypto[.]newsin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.