{
  "family": "teamspy",
  "sample_count": 2,
  "category": "backdoor",
  "description": "Backdoor:Win32/Teamspy (also known as TeamSpy Crew or 'The TeamSpy Operation') is a highly sophisticated cyber-espionage toolkit (APT). Its defining characteristic is the weaponization and abuse of a legitimate, widely used remote administration tool: TeamViewer. By hijacking legitimate software (`T1219`), TeamSpy operates with extreme stealth, bypassing many heuristic and behavioral defenses because the core remote access activity looks exactly like standard IT support.<br><br><b>Understanding TeamSpy (Living off the Land)</b><br>To an end-user, the infection is completely invisible; the attackers take great pains to hide the TeamViewer interface. For a security operations center (SOC), TeamSpy is incredibly difficult to detect without deep analysis, as the network traffic is indistinguishable from authorized remote support sessions. It targets high-value individuals, industrial sectors, and government entities to steal sensitive documents, encryption keys, and proprietary data.<br><br><b>Execution and Subversion Mechanics</b><br>TeamSpy is typically deployed via highly targeted spear-phishing campaigns containing malicious attachments or links (`T1566.001`). Once initial access is gained, the malware drops a fully functional, legitimate version of TeamViewer alongside malicious, dynamically loaded libraries (DLLs). It utilizes DLL Search Order Hijacking or DLL Side-Loading (`T1574.002`) to force the legitimate TeamViewer executable to load the attacker's malicious DLL. This DLL radically alters TeamViewer's behavior: it hides the GUI, suppresses user notifications, hardcodes the access password, and configures it to run silently as a service. This grants the attacker persistent, interactive, graphical remote access (`T1059`) completely bypassing the victim's awareness.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the catastrophic, long-term theft of highly sensitive data. Host-based IoCs include EDR alerts for anomalous DLL loads into `teamviewer.exe` (specifically looking for unsigned DLLs or unexpected file paths like `%AppData%`), and the presence of suspicious configuration files (like `tv.ini` or `.cfg`) overriding default TeamViewer settings. Network IoCs are challenging, as the traffic flows to legitimate TeamViewer infrastructure, but anomalies in session duration or connections outside of normal business hours can be indicators.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Teamspy and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Teamspy is classified as a Backdoor. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Teamspy establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Teamspy typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Teamspy compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Teamspy should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What remote administrative and surveillance capabilities does Teamspy provide to threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As an interactive backdoor and remote access tool, Teamspy grants operators comprehensive control over the victim host. Common surveillance and management modules include real-time keystroke logging, desktop screen capture, remote VNC streaming, webcam and audio recording, arbitrary shell command execution, reverse proxy pivoting, and bidirectional file transfer capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Teamspy traverse firewalls and sustain resilient command-and-control (C2) connections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Teamspy establishes persistent outbound TCP or TLS connections back to threat actor infrastructure, effectively bypassing inbound firewall filtering. To maintain connection resilience against IP takedowns, variants frequently employ dynamic DNS services, fallback command servers, encrypted dead-drop resolvers on social platforms, or DNS over HTTPS (DoH) querying."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1219",
    "T1574.002",
    "T1566.001",
    "T1114"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Weaponizing TeamViewer for stealthy access)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading (Forcing TeamViewer to load malicious code)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1114",
      "name": "Email Collection (A common objective for the TeamSpy operators)",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Initial access vector)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint; the attackers likely have interactive, GUI-based control of the system.",
    "If TeamViewer is not an authorized enterprise application, block its execution entirely via AppLocker and block its network ports/domains.",
    "Conduct a deep forensic review of the compromised system, specifically hunting for staged exfiltration archives (.rar, .zip).",
    "Force a password reset for all accounts accessed by the user, as TeamSpy includes comprehensive credential dumping capabilities."
  ],
  "what_to_avoid": [
    "Do not assume TeamViewer traffic is benign without verifying authorization; attackers actively use it to 'Live off the Land'.",
    "Avoid simply killing the TeamViewer process; the persistence mechanism (often a service) will restart it. Isolate the machine."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}