Loading story…
Researchers disclosed Speagle, a newly identified infostealer that abuses the functionality and infrastructure of Cobra DocGuard, a legitimate document security product from EsafeNet. The malware exfiltrates stolen data through a compromised Cobra DocGuard server, making the traffic appear to be normal client-to-server communications and helping the activity blend in with legitimate software use. Symantec and Carbon Black said the malware is highly selective, activating its collection and exfiltration behavior only on systems where Cobra DocGuard is installed, indicating deliberate targeting rather than broad opportunistic theft.
The activity is being tracked as Runningcrab and remains unattributed, although researchers assess that the operation may support intelligence collection or industrial espionage and could be linked to a state-backed actor or a contractor-for-hire. One report said Speagle appears capable of seeking highly specific material, including documents related to Chinese ballistic missiles. Researchers have not confirmed the initial infection vector, but they noted low-confidence signs consistent with a possible supply chain compromise, echoing earlier abuse of Cobra DocGuard in prior intrusions, including attacks previously tied to Carderbee and delivery of PlugX/Korplug against organizations in Hong Kong and elsewhere in Asia.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Symantec said the initial infection vector was unconfirmed but observed indicators consistent with a possible supply-chain attack involving Cobra DocGuard. The reporting also included defensive guidance such as checking Cobra DocGuard server integrity, monitoring outbound traffic, and updating endpoint detections.
Public reporting disclosed that Speagle performs staged host and browser data collection, with at least one variant searching for files related to Chinese ballistic missile and defense topics. Researchers also found it can self-delete by abusing Cobra DocGuard's legitimate FileLock driver and a known technique for deleting a running executable.
Researchers tracked the Speagle activity under the new cluster name Runningcrab. Based on selective targeting and collection interests, they assessed the operation may be linked to state-sponsored espionage or a capable private contractor, though attribution remained unconfirmed.
Symantec and Carbon Black researchers identified a new infostealer dubbed Speagle that only operates on systems with Cobra DocGuard installed. The malware uses a compromised Cobra DocGuard server for command-and-control and to disguise data exfiltration as normal product traffic.
Before the Speagle reporting, ESET and Symantec had documented earlier incidents in which trojanized or malicious Cobra DocGuard updates were used against organizations in Hong Kong and elsewhere in Asia. These prior cases established a broader pattern of abuse involving the software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Targeted threat actors used malicious Microsoft Office documents exploiting **`CVE-2012-0158`** to compromise victims in long-running espionage campaigns, including Tibetan organizations and primarily Russian-speaking individuals. Citizen Lab reported that trojanized Word attachments in 2012 and 2013 delivered the **Surtr** malware family, while Symantec documented the **Scarab** group using spearphishing emails, compressed archives, and later `.scr` droppers to install **Trojan.Scieron** and **Trojan.Scieron.B** on a small number of carefully selected systems each month. The malware families provided persistent backdoor and surveillance capabilities after infection. Surtr injected into `explorer` or `iexplore`, stored campaign and command-and-control data in the registry, and supported file listing, USB enumeration, web cache viewing, remote command execution, and keylogging, with observed C2 including **`internet.3-a.net`** on port `9696` and a second-stage payload named **`x86_GmRemote.dll`**. Scieron acted as a downloader and backdoor, while Scieron.B added stronger remote access features and a rootkit-like component to hide some network activity; Symantec said Scarab’s infrastructure relied on dynamic DNS and C2 servers commonly hosted in South Korea. The campaigns showed that the widely exposed Microsoft Windows Common Controls ActiveX flaw affected numerous Microsoft products and remained a practical delivery vector for tailored espionage operations.
Aug 15, 2026
Trellix reported a new wave of **SquidLoader** malware targeting financial services organizations in Hong Kong through spear-phishing emails carrying password-protected RAR archives. The infection chain spans five stages: a disguised PE file posing as a Microsoft Word document and a fake `AMDRSServ.exe`, self-unpacking and anti-analysis routines, command-and-control communication, and final in-memory deployment of a **Cobalt Strike Beacon**. At the time of analysis, the sample had near-zero detection on VirusTotal and displayed a fake Mandarin corruption error message to mislead victims. The malware used layered evasion techniques including **PEB walking**, dynamic API resolution, string overwriting, debugger and sandbox checks, and APC/thread-based anti-emulation. Trellix said the primary C2 URL used a Kubernetes-themed path to blend into normal traffic, while the malware collected host data including IP address, username, computer name, Windows version, and privilege level. Researchers also identified related low-detection samples linked to Singapore and Australia, indicating a broader regional campaign using similar infrastructure and tradecraft.
Aug 14, 2026
Researchers assessing an espionage campaign targeting East Asian companies since May 2023 said the activity likely focused on semiconductor and rare-metal sectors and used the **Xiangoop Loader** to deliver fileless payloads including **Cobalt Strike Beacon**, **EntryShell**, and in some cases **CrowDoor** through **SparrowDoor Loader**. Malware analysis found strong overlap between EntryShell and the older **KeyBoy** family, including matching embedded and encrypted strings, leading investigators to assess EntryShell as an updated KeyBoy variant. The same research identified technical overlap between **CrowDoor** and **SparrowDoor**, including identical loader shellcode and shared structural and command features, strengthening the case that **Tropic Trooper** and **FamousSparrow** are either the same threat actor or closely aligned operators. Earlier reporting on FamousSparrow described a cyberespionage group active since at least 2019 that exploited internet-facing applications such as **Microsoft Exchange** via **ProxyLogon**, **Microsoft SharePoint**, and **Oracle Opera** to deploy **SparrowDoor**, a backdoor capable of persistence, host reconnaissance, file theft, process creation, shellcode injection, and interactive remote shell access.
Aug 15, 2026