{
  "family": "spyagent",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Spyware:Win32/Spyagent is a highly prevalent malware family (and sometimes a commercial 'employee monitoring' tool abused by attackers) designed to comprehensively monitor and record a user's activity. Its primary goal is absolute stealth, operating invisibly to capture keystrokes, take screenshots, record application usage, and steal credentials, subsequently exfiltrating this data to a remote attacker.<br><br><b>Understanding Spyagent</b><br>To an end-user, a Spyagent infection is entirely invisible. The system runs normally, with no ransom notes or visible windows. For an enterprise security team, Spyagent represents a critical, ongoing breach of confidentiality. Because it can be compiled from commercial 'stalkerware' sources, it is often used in targeted corporate espionage or by malicious insiders.<br><br><b>Execution and Surveillance Mechanics</b><br>Spyagent is typically delivered via spearphishing attachments (`T1566.001`) or installed physically by a malicious insider (`T1091`). Upon execution, it establishes deep persistence, often running as a hidden Windows Service (`T1543.003`) or creating heavily obfuscated Registry Run keys (`T1547.001`). Once active, Spyagent hooks the `SetWindowsHookEx` API to capture every keystroke typed (`T1056.001`). It regularly queries the `GetForegroundWindow` API to log which applications are in focus, taking periodic screenshots (`T1113`). It may also scrape the clipboard (`T1115`) and extract saved passwords from browsers (`T1555.003`). The massive volume of harvested data is encrypted, compressed into archive files (e.g., `.zip` or `.cab`), and exfiltrated via FTP, SMTP, or HTTP (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, prolonged data loss, including intellectual property, passwords, and sensitive communications. Host-based IoCs include EDR alerts for extensive API hooking, the presence of hidden, growing log files (often encrypted) in the `%AppData%` or `%Temp%` directories, and unknown processes running as a Service. Network IoCs include regular, scheduled outbound connections (e.g., every 60 minutes) to unknown FTP servers or SMTP relays to deliver the logs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Spyagent and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spyagent is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Spyagent establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spyagent typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Spyagent compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Spyagent should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Spyagent leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spyagent frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Spyagent maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spyagent often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1113",
    "T1048",
    "T1543.003",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol (FTP/SMTP)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network to halt the exfiltration of the recorded logs.",
    "Assume all credentials, emails, and sensitive documents accessed on the compromised machine have been stolen. Initiate an enterprise-wide password reset for the affected user.",
    "Preserve the system state (RAM dump) to analyze the running spyware process and locate the local staging directory where it stores its encrypted logs before exfiltration.",
    "Review firewall and proxy logs to identify the external FTP/SMTP servers used for exfiltration and block them."
  ],
  "what_to_avoid": [
    "Do not allow the user to change their passwords *from the infected machine*; the spyware will simply record the new credentials.",
    "Avoid closing the incident simply by deleting the executable; ensure a full investigation determines exactly what data was lost."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}