Full Report
Novel, parasitic threat cleverly uses Cobra DocGuard’s functionality and hunts for documents related to ballistic missiles.
Analysis Summary
# Tool/Technique: Infostealer.Speagle
## Overview
Infostealer.Speagle is a novel, parasitic malware designed to hijack the functionality and infrastructure of the legitimate document security software **Cobra DocGuard** (developed by EsafeNet). Its primary purpose is the surreptitious harvesting of sensitive information, specifically targeting documents related to ballistic missiles. It masks its exfiltration traffic as legitimate client-server communication between Cobra DocGuard and its compromised servers.
## Technical Details
- **Type:** Malware family (Infostealer)
- **Platform:** Windows (32-bit .NET executable)
- **Capabilities:** Information theft, targeted document harvesting, anti-tamper bypass, and self-deletion.
- **First Seen:** Reported March 19, 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.002 - Supply Chain Compromise: Software Dependencies] (Hypothesized)
- **[TA0007 - Discovery]**
- [T1012 - Query Registry]
- [T1082 - System Information Discovery]
- [T1083 - File and Directory Discovery]
- **[TA0009 - Collection]**
- [T1560 - Archive Collected Data] (Use of "ErrorReport" structure)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- **[TA0005 - Defense Evasion]**
- [T1070.004 - Indicator Removal: File Deletion]
- [T1564.010 - Hide Artifacts: Process Rename]
## Functionality
### Core Capabilities
- **Environmental Dependency:** The malware only proceeds with execution if it detects a Cobra DocGuard installation via registry keys or hardcoded paths.
- **System Profiling:** Collects the Windows username, hostname, `clientId`, and `oldId` from Cobra DocGuard configuration files (`UniqueClientCode.ini` and `PackageInfo.ini`).
- **Data Structuring:** Uses a custom internal structure labelled "ErrorReport" by developers to organize stolen data before transmission.
- **Phased Exfiltration:** Operates in stages, attempting to exfiltrate collected data immediately after each phase to ensure partial success if the process is interrupted.
### Advanced Features
- **Infrastructure Hijacking:** Utilizes compromised legitimate Cobra DocGuard C2 servers to mask exfiltration traffic as standard diagnostic pings.
- **Stealthy Self-Deletion:** Employs a specific technique using the `SetFileInformationByHandle()` API to rename itself to a random 6-letter string before deletion, bypassing certain security locks.
- **Targeted Intelligence:** Specifically programmed to hunt for documents related to Chinese ballistic missiles, suggesting high-level industrial or state-sponsored espionage.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b`
- `dcd3f06093bf34d81837d837c5a5935beb859ba6258e5a80c3a5f95638a13d4d`
- `fad8d0307db5328c8b9f283a2cc6f7e4f4333001623fef5bd5c32a1c094bf890`
- `d7f167cbf1676c14fd487219447e30fadf26885eb25ec4cafdeabe333bddf877`
- **Registry Keys:**
- `HKLM\SOFTWARE\WOW6432Node\Esafenet\CDG System\InstallDir`
- `HKLM\SOFTWARE\Esafenet\CDG System\InstallDir`
- **Network Indicators:**
- `hxxp://60.30.147[.]18:8091/CDGServer3/CDGClientDiagnostics?flag=syn_user_policy`
- `hxxp://222.222.254[.]165:8090/CDGServer3/CDGClientDiagnostics?flag=syn_user_policy`
- **Behavioral Indicators:**
- Unauthorized modifications to `C:\ProgramData\EstConfig.ini`.
- Process calling `SetFileInformationByHandle` for self-renaming to numeric/random strings.
## Associated Threat Actors
- **Runningcrab** (Temporary designation; suspected state-sponsored or high-end private contractor).
## Detection Methods
- **Signature-based:** Use the provided SHA256 hashes to block known Speagle binaries.
- **Behavioral:** Monitor for unexpected network traffic originating from security software to unfamiliar external IP addresses, especially those involving "ClientDiagnostics" URI strings.
- **File Integrity:** Monitor for changes to `PackageInfo.ini` and `UniqueClientCode.ini` within Cobra DocGuard installation directories.
## Mitigation Strategies
- **Network Segmentation:** Restrict outbound communications from document security servers to known, trusted update endpoints only.
- **Supply Chain Validation:** Implement strict verification for software updates for Cobra DocGuard, given its history of compromise.
- **Endpoint Protection:** Use modern EDR solutions capable of detecting the `SetFileInformationByHandle` renaming/deletion technique.
## Related Tools/Techniques
- **Cobra DocGuard:** The legitimate software targeted for hijacking.
- **Korplug (PlugX):** Previously delivered via Cobra DocGuard supply chain attacks by the group Carderbee.
- **Carderbee:** An APT group known for similar supply chain tactics targeting the same software.