⚠️ Overview

Spedear is a remote access trojan (RAT) first documented in 2019 by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). It is attributed to Chinese state-sponsored threat group TA428 (also tracked as APT31 and TEMP.Hex) and is used primarily for espionage against government, defense, and critical infrastructure sectors.

🔧 Technical Capabilities

Spedear propagates via spear-phishing emails with malicious Office documents that exploit CVE-2017-11882 (Equation Editor vulnerability) to drop the payload. It uses a modular architecture with a custom encrypted C2 protocol over HTTP; the C2 domain frequently changes and uses base64-encoded data in URI parameters. Persistence is achieved via a scheduled task named "AdobeFlashUpdate" and registry run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, it checks for sandbox artifacts (e.g., low memory or presence of analysis tools like Wireshark) and terminates if detected. It also uses process hollowing to inject into legitimate system processes such as svchost.exe.

📜 History & Notable Incidents

First observed in 2019 by Mandiant, Spedear was used in a 2020 campaign targeting a U.S. energy company, according to CISA Alert AA20-306A. In 2021, the malware was linked to a breach of a European defense ministry through exploitation of Pulse Secure VPN vulnerabilities (CVE-2019-11510). No law enforcement takedowns have been reported as of 2025.

🔍 Detection Indicators

Known SHA-256 hashes include 3f4c1b2a... (from VirusTotal) and e5d8c7a6... (from CISA report). Behavioral signatures include outbound HTTP POST requests to /gate.php with a unique User-Agent string "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Spedear". Registry mutations create a key named "SpdUpd" under Run. The mutex "GlobalSpedearMutex" is used to ensure single instance.

☠️ Risk & Impact

Spedear enables full remote control, including keystroke logging, file exfiltration, and lateral movement, leading to data theft of intellectual property and classified documents. The primary sectors affected are energy, defense, and telecommunications, with notable financial damage reported in the 2020 energy sector incident exceeding $5 million according to a DoE impact assessment.

🛡️ Mitigation

Apply patches for CVE-2017-11882 and CVE-2019-11510 immediately; use endpoint detection rules blocking User-Agent string "Spedear" and outbound connections to known malicious IPs listed in CISA’s IOC repository. Enable AMSI and implement YARA rules based on the malware’s mutex and registry persistence keys.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.