TeamSpy TeamSpy

  • First known sample

    2004

  • Discovery

    2013

  • Number of targets

    1000-3000

  • Current status

    Inactive since 2014

  • Type

    Remote administration tool

  • Targeted platforms

    Windows

  • TOP targeted countries

    Cambodia , Eastern Europe

  • The way of propagation

    Exploits , Social engineering

  • Purpose/Functions

    Cyberespionage , Data wiping
  • Special features
    The attackers control the victims’ computers remotely using the legal remote administration tool TeamViewer. This application is signed with legitimate digital certificates and is used by more than 100 million users around the world.

  • Targets

    Activists , Heavy industry manufacturers , Intelligence agencies
  • Artefacts/Attribution
    Russian-speaking authors
  • Description

    A cyber-surveillance operation targeting high-level political and human rights activists throughout the CIS region and Eastern European nations, as well as government agencies and private companies. The attacks have been ongoing for almost a decade and make use of the legal remote administration tool TeamViewer to control the victims’ computers remotely.

    Additional information

© 2025 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com