TEAMSPY
Your consent is required to display this content from youtube - Privacy Settings
Type: Cyber Espionage
Status: Active Feb 2017
Other Names: TeamSpy Crew
Active Since/Discovered: 2004/ March 2013
Targets:
- Eastern Europe
- most victims are ordinary users, but some are high-profile industrial, research, or diplomatic targets
- high level political and human rights activists throughout CIS and Eastern European nations
- government agencies
- private companies
- Belarusian activists in 2012
Target Sectors:
- Activists
- Energy, oil and gas companies
- Heavy industry manufacturers
- Intelligence agencies
Malware:
- TeamViewer RAT
- Keylogger and screen capture
- Legitimate digital certificates
- Dynamically Patched in memory to obfuscate application
Preferred Attack Vector: Social Engineering and Exploits
IoCs:
- Stolen data includes: crypto keys, passwords, documents, proprietary information, Apple iOS device history data from iTunes, Detailed OS and BIOS information