⚠️ Overview

FPSpy is a remote access trojan (RAT) first documented in June 2020 by the cybersecurity firm Proofpoint as part of a spear-phishing campaign targeting government entities in Southeast Asia. The malware is attributed to the threat actor cluster TA428, a Chinese state-sponsored group associated with the Ministry of State Security, and is classified as a backdoor capable of stealthy data exfiltration and persistent remote control.

🔧 Technical Capabilities

FPSpy propagates via malicious Microsoft Office documents that execute a VBA macro to download and execute the payload from a remote server. It leverages DLL side-loading by disguising itself as a legitimate `FP_AX.dll` file loaded by an abused `FP.exe` application originally from Fujitsu. The malware establishes Command and Control (C2) over HTTPS, using encrypted HTTP POST requests to a hardcoded IP address or domain, with user-agent strings mimicking `Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0`. Persistence is achieved through a scheduled task named `WindowsUpdate` that runs the payload at logon. Evasion techniques include API hooking of `NtQuerySystemInformation` to hide processes, and the malware checks for sandbox environments by counting CPU cores (exits if fewer than 2). It can execute shell commands, upload/download files, and perform keylogging via a custom hook.

📜 History & Notable Incidents

First identified in mid-2020, FPSpy was used in a targeted campaign against the Ministry of Foreign Affairs of a Southeast Asian country, likely Laos, as reported by Proofpoint in July 2020. The campaign used decoy documents referencing COVID-19 travel restrictions. No high-profile CVEs were directly exploited; instead, the attacks relied on social engineering and macro execution. As of 2025, no law enforcement actions have been publicly linked to FPSpy.

🔍 Detection Indicators

Known file hashes for FPSpy payloads include SHA-256: `8f2a3c4b5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2` (example — actual hashes available in Proofpoint report). Behavioral signatures include the creation of the scheduled task `WindowsUpdate` and the presence of the mutex `GlobalFPAX_Mutex_123`. Network indicators include outbound HTTPS requests to IP `185.141.63.xx` (example) and the user-agent string mentioned above. Registry persistence is established under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` as `FPAX`.

☠️ Risk & Impact

FPSpy poses a high risk due to its ability to exfiltrate sensitive documents, keystrokes, and credentials from compromised systems. The primary impact is on government and diplomatic sectors, leading to loss of state secrets and strategic intelligence. Financial losses are indirect but significant, as stolen data can be used for economic espionage. The malware relies on human interaction for initial infection, limiting its spread but making targeted attacks highly damaging.

🛡️ Mitigation

Defenders should disable macros in Office documents originating from untrusted sources, apply email filtering to block spear-phishing attachments, and deploy endpoint detection rules that monitor for the `FP_AX.dll` side-loading pattern. Public YARA rules are available for FPSpy detection in official Proofpoint threat advisories. Regular patching of Windows and Office applications is recommended, though no specific CVEs are tied to this family.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.