Spearal
Spearal is a .NET backdoor used by the Iran-aligned threat group BladedFeline, which ESET assesses with medium confidence to be a sub-cluster of OilRig (APT34). It has been reported in multi-stage intrusion campaigns targeting Kurdish and Iraqi government officials and entities, with broader BladedFeline targeting also including the Kurdistan Regional Government, Iraqi government networks, diplomatic officials, governmental organizations in Azerbaijan, and a regional telecommunications provider in Uzbekistan. Spearal is described as a bespoke backdoor that uses DNS tunneling for command-and-control communication. Reporting places it alongside other BladedFeline backdoors such as Whisper/Veaty and Optimizer, and the group’s toolkit is described as providing remote code execution and data exfiltration capabilities. The initial access vector for related KRG and Iraqi intrusions is unclear, though researchers suspected exploitation of an internet-facing application in some cases. No Spearal-specific indicators of compromise beyond its malware family name and its DNS-tunneling C2 mechanism are directly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...the group intensified operations against Iraqi government entities through a multi-stage intrusion campaign deploying novel malware families, including the Veaty and Spearal backdoors...
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Stealth
2 techniques
Stealth
Command and Control
3 techniques
Command and Control
Finally, for command and control and exfiltration, Iranian-linked groups most commonly rely on application layer protocols (T1071), such as HTTP
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
APT34 backdoor using custom DNS tunneling and email-based C2, deployed against Iraqi government targets.
Backdoor used in targeted intrusions against Kurdish and Iraqi government officials.
Backdoor used by BladedFeline providing remote code execution and data exfiltration.
.NET backdoor that uses DNS tunneling for command-and-control communications.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.