Malware

Speagle

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Exactly how the malware is delivered to victims is unknown, although it's suspected that it may have been done via a supply chain attack, as evidenced by the two aforementioned cases.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

How Speagle abuses trusted Cobra DocGuard functionality.

Stealth

3 techniques

T1036MasqueradingEvidence1

How stolen data is disguised as legitimate error reports.

T1070Indicator RemovalEvidence1

Why the malware’s self-cleaning behavior stands out.

T1070.004File DeletionEvidence1

...it also invokes a driver associated with the program to delete itself from the compromised host.

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

This includes details about the system and files located in specific folders, such as those that contain web browser history and autofill data.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

This includes details about the system and files located in specific folders, such as those that contain web browser history and autofill data.

T1083File and Directory DiscoveryEvidence1

The 32-bit .NET executable, once launched, first checks the installation folder of Cobra DocGuard and then proceeds to harvest and transmit data from the infected machine in phases. This includes details about the system and files located in specific folders...

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

Not only does Speagle use a legitimate Cobra DocGuard server for command-and-control (C2) and as a data exfiltration point...

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

Speagle is designed to surreptitiously harvest sensitive information from infected computers and transmit it to a Cobra DocGuard server that has been compromised by the attackers, masking the data exfiltration process as legitimate communications between client and server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

symantec blogNews

Jun 26, 2026

🎙️SECURITY.COM The Podcast: The Parasite in the Machine: Unmasking the Speagle Infostealer | SECURITY.COM

Speagle is malware that abuses Cobra DocGuard functionality, appears to search for missile-focused keywords, disguises stolen data as legitimate error reports, and exhibits self-cleaning behavior.

the hacker newsNews

Mar 19, 2026

Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

A novel information-stealing malware that abuses Cobra DocGuard functionality and infrastructure to harvest sensitive data from infected systems and exfiltrate it to a compromised Cobra DocGuard server while disguising the traffic as legitimate client-server communications. It specifically targets systems with Cobra DocGuard installed and can collect system details, files, browser history, and autofill data; one variant can toggle collection types and search for files related to Chinese ballistic missiles like Dongfeng-27.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Speagle

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Exactly how the malware is delivered to victims is unknown, although it's suspected that it may have been done via a supply chain attack, as evidenced by the two aforementioned cases.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

How Speagle abuses trusted Cobra DocGuard functionality.

Stealth

3 techniques

T1036MasqueradingEvidence1

How stolen data is disguised as legitimate error reports.

T1070Indicator RemovalEvidence1

Why the malware’s self-cleaning behavior stands out.

T1070.004File DeletionEvidence1

...it also invokes a driver associated with the program to delete itself from the compromised host.

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

This includes details about the system and files located in specific folders, such as those that contain web browser history and autofill data.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

This includes details about the system and files located in specific folders, such as those that contain web browser history and autofill data.

T1083File and Directory DiscoveryEvidence1

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

Not only does Speagle use a legitimate Cobra DocGuard server for command-and-control (C2) and as a data exfiltration point...

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

symantec blogNews

Jun 26, 2026

🎙️SECURITY.COM The Podcast: The Parasite in the Machine: Unmasking the Speagle Infostealer | SECURITY.COM

Speagle is malware that abuses Cobra DocGuard functionality, appears to search for missile-focused keywords, disguises stolen data as legitimate error reports, and exhibits self-cleaning behavior.

the hacker newsNews

Mar 19, 2026

Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.