KnSpy
- First seen
- 2016-10-01 00:00:00
- Malware type
- spyware, rat
- Family
- Malware family
- Last IoC activity
- 2026-07-21 10:31:02
- Profile updated
- 2026-07-07 14:08:00
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:cn country_code:kz
Context
KnSpy is a sophisticated malware family used in cyber espionage campaigns targeting government and technology sectors, primarily in East Asia and Central Asia. It serves as both spyware and a remote access tool (RAT) to gather sensitive information.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Knspy (report)
- blogs.360.cn — Apt C 35 Target At Armed Forces In Pakistan (report)
- Cisco Talos — Donot Firestarter (report)
- community.riskiq.com — 6F60Db72 (report)
- twitter.com — 1267571622732578816 (report)
- cybleinc.com — Donot Team Apt Group Is Back To Using Old Malicious Patterns (report)
- s.tencent.com — 951 (report)