⚠️ Overview

TeamSpy is a remote access trojan (RAT) first documented by Trend Micro in 2015, attributed to the Chinese threat group Gallium (MITRE ATT&CK group G0075, also tracked as APT10 and Barium). It is a modular malware framework designed for intelligence gathering and persistent remote access to victim networks.

🔧 Technical Capabilities

TeamSpy gains initial access via spear-phishing emails containing malicious Office documents that exploit known vulnerabilities such as CVE-2012-0158 or rely on macro execution. It establishes persistence through scheduled tasks and registry Run keys, often under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values like 'UpdateService'. C2 communication occurs over HTTPS using RSA-encrypted payloads, sometimes proxied through compromised legitimate websites. The malware incorporates a modified version of TeamViewer for interactive remote control. Evasion techniques include process injection into explorer.exe and svchost.exe, use of custom packers, and stolen code-signing certificates. Capabilities include keylogging, screen capture, file theft, credential harvesting, and execution of modular plugins downloaded from the C2 server. Data exfiltration is performed via HTTP, FTP, or email.

📜 History & Notable Incidents

The earliest TeamSpy campaigns date to 2013, targeting Tibetan and Uyghur human rights activists, as documented by Kaspersky Lab in their report "TeamSpy: Espionage in the Third World". In 2015, Trend Micro published "Operation TeamSpy", revealing a multi-year campaign against government, military, and telecommunications entities in Vietnam, the Philippines, Malaysia, and Indonesia. The Gallium group has continued using TeamSpy alongside other custom malware such as Quarian and Bisonal, with activity persisting through 2022.

🔍 Detection Indicators

MITRE ATT&CK entry S0306 documents specific indicators including mutex names TeamSpyMutex and Global\TeamSpyMutex. Network indicators include C2 domains mimicking legitimate services (e.g., update.microsoft-security.com) and outbound HTTPS connections on port 443 to servers in China and the United States. Behavioral signatures include process injection into explorer.exe, registry modifications under Run keys, and execution of modified TeamViewer binaries. File hashes are listed in the ATT&CK entry and in Trend Micro's report.

☠️ Risk & Impact

TeamSpy enables prolonged data exfiltration of classified government documents, military intelligence, and corporate intellectual property. Affected sectors include national government agencies, defense contractors, telecommunications providers, and human rights organizations. The real-world impact includes compromised national security, economic espionage, and suppression of dissident activities in targeted regions.

🛡️ Mitigation

Defenders should enforce email security gateways to block spear-phishing attachments, apply patches for Microsoft Office vulnerabilities (e.g., CVE-2012-0158), deploy endpoint detection and response (EDR) with behavioral rules for process injection and unauthorized TeamViewer usage, and monitor network traffic for anomalous HTTPS connections to known malicious C2 domains. Network segmentation and the principle of least privilege can limit lateral movement.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.