{
  "family": "picsys",
  "sample_count": 82,
  "category": "trojan",
  "description": "PicSys (cataloged by security vendors under detections including Trojan:Win32/PicSys, Trojan.Win32.Picsys, and Worm.Win32.PICSYS) is a covert surveillance trojan and spyware threat active since 2011. Typically distributed via pirated software cracks, deceptive image-viewing utilities, and malicious spearphishing email attachments, PicSys is engineered to perform comprehensive endpoint surveillance without user detection. Once resident on Windows, PicSys drops persistence copies into system directories and hooks Windows message queues to record all user keystrokes (keylogging), captures periodic desktop screenshots during active user sessions, and monitors active application windows. Furthermore, PicSys compiles stolen system credentials, document files, and user telemetry into encrypted archives and exfiltrates them to attacker-controlled command-and-control servers via HTTP, FTP, or SMTP channels.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/PicSys",
    "Trojan.Win32.Picsys",
    "Worm.Win32.PICSYS",
    "Win32/PicSys"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/PicSys?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PicSys is a surveillance trojan and spyware program that records keystrokes, takes screenshots, and steals documents."
      }
    },
    {
      "@type": "Question",
      "name": "How does PicSys monitor victim activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks keyboard message queues to log keystrokes and captures periodic screenshots of desktop sessions."
      }
    },
    {
      "@type": "Question",
      "name": "How does PicSys exfiltrate captured surveillance data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It compiles stolen keystrokes and files into encrypted archives and transmits them to C2 servers via HTTP, FTP, or email."
      }
    },
    {
      "@type": "Question",
      "name": "How does PicSys infiltrate user workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive image viewer utilities, pirated software cracks, and spearphishing attachments."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken following a PicSys alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, run an offline antimalware scan to remove keylogger hooks, and reset all account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1204.002",
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1113",
    "T1005",
    "T1041",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; the aggressive system modifications make the machine fundamentally untrustworthy and likely open to secondary payloads.",
    "Utilize EDR or offline registry analysis tools to identify and reverse the malicious registry modifications (especially those disabling security tools).",
    "Audit the `HOSTS` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) and remove any entries redirecting security vendor domains to `127.0.0.1`.",
    "Due to the depth of the system modifications, the most secure remediation is a complete, clean rebuild of the operating system."
  ],
  "what_to_avoid": [
    "Do not trust the endpoint's built-in security tools or logs; a Picsys infection is explicitly designed to disable or tamper with these mechanisms.",
    "Avoid relying solely on automated AV removal, as the malware may have replaced legitimate system files that AV cannot safely delete."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Information Theft & Surveillance",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Image Utilities",
    "Pirated Software & Cracks",
    "Spearphishing Email Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Keystroke Logging",
    "Screenshot Capture",
    "Sensitive Document Theft",
    "Encrypted Exfiltration (HTTP/FTP)",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound HTTP/FTP connections uploading encrypted surveillance archives",
      "Encrypted C2 check-in beacons"
    ],
    "evasion_techniques": [
      "Process injection into svchost.exe",
      "Archive encryption masking exfiltrated document contents"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PicSys",
      "Scheduled Task execution"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Low",
    "scope": "User credentials, desktop privacy, sensitive corporate documents"
  },
  "lineage": {
    "derived_from": [
      "Generic Win32 Spyware Families"
    ],
    "variants": [
      "PicSys.A",
      "PicSys.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c",
      "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b"
    ],
    "delivery": [
      "photo_viewer_setup.exe",
      "picsys_core.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PicSysAgent",
      "%AppData%\\PicSys\\picsys_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Picsys",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Picsys/"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/PicSys",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/PicSys"
    }
  ]
}