SPECTRUM
SPECTRUM, publicly reported as SPECTR, is malware used by the Russia-linked threat actor TEMP.Vermin, which CERT-UA has linked to security agencies of the so-called Luhansk People’s Republic (LPR/LNR). High-confidence reporting places it alongside VERMONSTER and FIRMACHAGENT in campaigns using lure content themed around drone production and development, anti-drone defense systems, and video surveillance security systems. The activity targeted organizations and individuals connected to the defense sector and the Russia-Ukraine war, particularly aerospace, drone, and related military technology themes. The content further characterizes TEMP.Vermin’s tooling set, including SPECTRUM/SPECTR, as being weaponized for surveillance and drone/anti-drone operations. No specific technical infection chain, platform details, or standalone indicators of compromise for SPECTRUM are provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TEMP.Vermin, an espionage actor whose activity Ukraine's Computer Emergency Response Team (CERT-UA) has linked to security agencies of the so-called Luhansk People's Republic (LPR, also rendered as LNR), has deployed malware including VERMONSTER, SPECTRUM (publicly reported as Spectr), and FIRMACHAGENT via the use of lure content themed around drone production and development, anti-drone defense systems, and video surveillance security systems.
"TEMP.Vermin ... has used malware like VERMONSTER, SPECTRUM (aka SPECTR), and FIRMACHAGENT..."
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used for surveillance and drone/anti-drone operations in battlefield contexts.
Malware deployed by TEMP.Vermin using aerospace/drone-themed domains (no further functional detail provided in the content).
Malware used by TEMP.Vermin in lure-based campaigns tied to drone/defense themes.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.