Malware

TVRat

TVRAT, commonly known as TeamSpy and also referred to as TVSPY, is a Windows remote-access trojan that abuses legitimate TeamViewer components to provide covert remote control of compromised systems. Observed TeamSpy implementations use DLL side-loading or search-order hijacking against signed TeamViewer binaries, conceal TeamViewer user-interface elements, and provide operators with the compromised host's TeamViewer identifier for remote access. Reported functionality includes remote control, file transfer, collection and exfiltration of victim data, and, in some variants, access to the microphone and webcam. TVRAT has been delivered through socially engineered documents, including job-application lures and malicious Excel attachments that require victims to enable macros; it has also appeared as a follow-on payload in phishing and cryptocurrency-themed lure campaigns. In a U.S. criminal case, prosecutors alleged that TVRAT and DarkVNC were distributed through fraudulent accounts on a freelance-employment platform and used to collect victim data for subsequent fraud. TVRAT has also been deployed as a secondary payload following Ursnif infections.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

The command-and-control domains were paid for using virtual currency, and thousands of computers infected by the TVRAT malware were 'calling back' to a command-and-control domain hosted in the United States.

Initial Access

2 techniques

T1566.001Spearphishing AttachmentEvidence8

The conspirators allegedly created approximately 255 fake user accounts and used them to send messages containing malicious Excel attachments to around 80,000 freelancers.

T1566.003Spearphishing via ServiceEvidence1

Aktulaev and his co-conspirators built around 255 fake accounts on a well-known freelance work platform... [and] used those accounts to message roughly 80,000 users, posing as prospective clients.

Execution

4 techniques

T1059.005Visual BasicEvidence5

Opening an attachment prompted the recipient to enable or execute an embedded macro. If the user complied, the macro downloaded malware from the internet.

T1203Exploitation for Client ExecutionEvidence1

TVRAT allows its users to exploit a vulnerability in remote access tool TeamViewer and take over a victim’s device. DarkVNC... exploited a bug in... VNC Viewer.

T1204.002Malicious FileEvidence8

Opening an attachment prompted the recipient to enable or execute an embedded macro. If the user complied, the macro downloaded malware from the internet.

T1574.001DLLEvidence1

Вместе с подписанными бинарниками TeamViewer устанавливалась вредоносная библиотека msimg32.dll. Используя технику DLL hijacking, она загружалась вместо штатной DLL Windows.

Stealth

1 technique

T1574.001DLLEvidence1

Collection

1 technique

T1213Data from Information RepositoriesEvidence1

Aktulaev used the access to steal data from victims... Aktulaev kept a document with stolen e-commerce login credentials and personal information on hundreds of victims.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence4

Thousands of computers infected by the TVRAT malware were 'calling back' to a command-and-control domain hosted in the United States.

T1105Ingress Tool TransferEvidence5

If the user complied, the macro downloaded malware from the internet.

T1219Remote Access ToolsEvidence7

TVRAT and DarkVNC provided similar hidden remote-control capabilities... Prosecutors allege that the malware allowed the conspirators to control infected computers.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence7

Prosecutors allege that the malware allowed the conspirators to control infected computers and transfer stolen data to command-and-control servers.

Impact

1 technique

T1657Financial TheftEvidence1

Aktulaev used the access to steal data from victims and commit fraud.

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

19 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

20 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app9 months ago

hash.md5●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

cysecurity newsNews

Sep 3, 2026

Russian National Charged Over Malware Campaign Targeting 80,000 Freelancers - CySecurity News - Latest Information Security and Hacking Incidents

Remote-access malware that allegedly enabled the conspirators to control infected computers, steal information, and transfer stolen data to command-and-control servers. It incorporated or abused components associated with TeamViewer.

scworldNews

Sep 3, 2026

Russian national charged in US for malware scheme targeting 80,000 users | brief | SC Media

A remote-access trojan used to remotely control infected systems and exfiltrate stolen data to command-and-control servers.

xakepNews

Sep 3, 2026

Гражданина РФ обвиняют в атаках на 80 000 фрилансеров и распространении малвари TVRAT и DarkVNC - Хакер

Remote-access malware that abuses legitimate TeamViewer components. It uses DLL hijacking via a malicious msimg32.dll, hides the TeamViewer interface, reports the victim machine ID to operators, and enables remote access using a predefined password. It also steals information and exfiltrates it to a C2 server.

data breachesNews

Sep 3, 2026

Russian National Indicted For Exploiting Online Platform Used For Freelance Employment And Distributing Malware To Thousands Of Victims - DataBreaches.Net

A remote-access trojan allegedly delivered through malicious Excel macro attachments. It provides remote control of infected computers through TeamViewer and exfiltrates victim data to command-and-control infrastructure for collection and subsequent fraud or other criminal activity.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

TVRat