CSPY Downloader

MITRE ATT&CK: S0527 View on attack.mitre.org

Aliases: CSPY Downloader

First seen
2023-01-15 00:00:00
Malware type
downloader
Operating systems
windows
Profile updated
2026-07-07 12:51:38

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:kr

Context

CSPY Downloader is a tool designed to evade analysis and download additional payloads used by Kimsuky.

Detection coverage

  • 332 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • Modify Registry (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Code Signing (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Web Protocols (attack-pattern)
  • Malicious File (attack-pattern)
  • Bypass User Account Control (attack-pattern)
  • System Checks (attack-pattern)
  • Software Packing (attack-pattern)
  • Indicator Removal (attack-pattern)

Used by threat actors

Reports & references

  • cybereason.com — Back To The Future Inside The Kimsuky Kgh Spyware Suite (report)
  • MITRE ATT&CK — S0527 (report)

External references