Loading story…
Researchers and government defenders have linked multiple campaigns to SpyAgent—also tracked as TeamSpy, TVRAT, TeamBot, and Sheldor—a long-running malware family that hijacks legitimate remote administration tools to gain covert control of Windows systems. Early and later variants abused TeamViewer by delivering malicious Office documents through targeted spam or job-application lures, then installing signed TeamViewer components alongside a rogue DLL and configuration files. The malware used DLL search order hijacking and DLL side-loading to hide the remote-access interface, suppress user prompts, steal the victim’s TeamViewer ID, and enable data theft, arbitrary command execution, and persistent backdoor access while blending traffic with legitimate remote-support activity.
More recent activity showed the operators adapting both tooling and delivery to reduce detection. Deep Instinct reported that 2022 campaigns shifted from TeamViewer to Safib Assistant, a similar remote administration product, and used oversized droppers and inflated DLLs to evade scanning limits before moving to Inno Setup bundles containing the legitimate tool and SpyAgent alone. HP Wolf Security separately documented a blocked intrusion at a financial organization in which a resume-themed Word document launched TeamViewer and regsvr32.exe to execute a malicious DLL, with infrastructure tied to domains including morteson[.]com, creatorz123[.]top, 123faster[.]top, and thief[.]lol. The reporting shows a sustained espionage-oriented threat that continues to repurpose trusted remote-access software as malware delivery and command-and-control cover.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
In June 2022, the campaign dropped its cryptocurrency theme and moved back to Inno Setup droppers that bundled SpyAgent with legitimate Safib Assistant, reducing detection by appearing more benign.
In May 2022, SpyAgent operators switched to oversized droppers larger than 700MB and inflated DLLs above 1GB with zero-byte overlays to evade scanning limits in security tools and repositories.
A 2021 report showed SpyAgent moving away from TeamViewer hijacking to abusing Safib Assistant, a Russian TeamViewer-like remote administration tool, with fake cryptocurrency applications used as lures.
In January 2020, attackers targeted a financial organization with a malicious resume document uploaded to a legitimate job portal; when opened by an HR employee, it delivered a TVRAT/Spy-Agent variant abusing TeamViewer side-loading.
A 2016 report described Spy-Agent using DLL search order hijacking with TeamViewer 6.0, continuing the documented evolution of the malware family.
TeamSpy first appeared in 2013, and white papers from CrySyS Lab and Kaspersky Lab documented the malware's abuse of TeamViewer through DLL search order hijacking.
A 2011 report described the Sheldor malware using DLL search order hijacking with TeamViewer 5.0, an early documented precursor to later TeamSpy/SpyAgent activity.
The U.S. Department of Justice charged Searzhudin Tamirlanovich Aktulaev over an alleged 2016–2017 campaign that used fraudulent freelance-platform accounts and malicious Excel macros to distribute TVRAT/TeamSpy and DarkVNC to thousands of victims. Aktulaev was arrested in Cyprus in May 2025, extradited to the United States, and remanded to federal custody after appearing in San Francisco federal court; the allegations remain unproven and he denies guilt.
Deep Instinct confirmed that malware bundled with Safib Assistant was SpyAgent by interacting with active command-and-control infrastructure, including thief[.]lol resolving to 185.125.206[.]172 during analysis.
Heimdal Security reported that TeamSpy had resurfaced in a targeted spam campaign delivering malicious Excel attachments that installed the malware alongside TeamViewer components.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcelearn.microsoft.com
Open sourcedeepinstinct.com
Open sourcethreatresearch.ext.hp.com
Open sourceblog.avast.com
Open sourcecyber.nj.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point reported a targeted intrusion campaign that used malicious Excel macro documents masquerading as sensitive U.S. government finance material to compromise officials in government finance authorities and embassy personnel across Europe and other regions. The infection chain dropped AutoHotkey components that contacted command-and-control infrastructure, collected screenshots and host details, and then deployed a trojanized **TeamViewer** instance through **DLL side-loading**, giving the operator covert remote access and credential-theft capability. Observed victims included selected government revenue and finance officials in **Nepal, Guyana, Kenya, Italy, Liberia, Bermuda, and Lebanon**. Researchers linked the activity to related operations seen in 2017 and 2018 based on reused macro code, similar TeamViewer backdoors, Russian-language lures, and overlapping payload behavior, and they cited circumstantial ties to a Russian-speaking forum user known as **"EvaPiks"**. The campaign appeared financially motivated because the malware targeted banking, cryptocurrency, and online commerce services and the suspected developer was active on a Russian carding forum.
Aug 14, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Researchers documented two financially motivated malware operations using multi-stage delivery chains built around JavaScript and **MSI** installers. One campaign linked to **QakBot** used search-engine pay-per-click malvertising and fake **TeamViewer** and **Zoom** installers, with redirect infrastructure including `acehphonnajaya.com`, `homepagego.com`, and `bobforlacitycouncil.com`, ultimately leading to an MSI payload hosted at `richtools.info` and `216.120.201.170`. Analysis of the MSI found a QakBot stager with a modified configuration-decoding and C2 parsing routine, including an added flag field in C2 entries, suggesting the operators were testing or expanding malvertising as a delivery method. Proofpoint separately tracked **TA866** in a campaign dubbed **Screentime**, targeting organizations in the United States and Germany through email attachments and URLs routed via the **404 TDS** traffic distribution system. Its infection chain also relied on a JavaScript downloader and MSI package, which installed a VBS downloader called **WasabiSeed** that maintained persistence and fetched additional payloads. TA866 distinguished itself by deploying a **Screenshotter** tool to capture victims’ desktops for manual triage before selectively delivering follow-on malware, including an AutoHotKey-based **AHK Bot** for Active Directory profiling and in-memory **Rhadamanthys Stealer**, highlighting a broader criminal trend of using staged MSI-based infections to qualify victims before deeper compromise.
Aug 15, 2026