Loading malware…
SPECTR is a Windows information-stealing malware family used by the UAC-0020 intrusion cluster, also known as Vermin, in cyberespionage operations targeting Ukraine. It has been in use since at least 2019 and has been prominently associated with the SickSync campaign directed at Ukrainian defense and public-sector entities. The malware is linked to a threat operation associated with the so-called Luhansk People's Republic and aligned with Russian interests.
SPECTR is designed to collect sensitive information from compromised systems. Reported capabilities include periodic screenshot capture, theft of files from local storage, collection of data from removable USB media, and harvesting of credentials and other sensitive data from web browsers and messaging or communications applications including Element, Signal, Skype, and Telegram. The malware has been described as modular, with components dedicated to functions such as screenshot capture, file collection, USB data theft, and browser or social-application data theft.
A notable characteristic of SPECTR operations is the abuse of the legitimate SyncThing file-synchronization utility for exfiltration. In observed campaigns, attackers delivered trojanized SyncThing-based packages and used SyncThing’s peer-to-peer synchronization features to transfer stolen data from infected hosts, blending malicious activity with legitimate software behavior and complicating detection. Operators have also modified SyncThing-related components to reduce user visibility and support covert operation.
Observed delivery has relied on spearphishing emails carrying password-protected or self-extracting archives that include decoy documents, batch-script execution logic, and malicious packages embedding both legitimate SyncThing components and SPECTR modules. The malware has been used in espionage-focused intrusions rather than disruptive or destructive attacks, with emphasis on credential access and data theft from strategically relevant Ukrainian targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware that enables theft of browser and app credentials, USB drive data, and captures files and screenshots from targeted devices, exfiltrating data via the SyncThing app.
SPECTR is a modular espionage malware used by the Vermin (UAC-0020) group for data theft and exfiltration. It includes modules for screenshot capture, file and USB data theft, and stealing credentials from browsers and messengers. It leverages legitimate tools like SyncThing for data exfiltration.
SPECTR is an information-stealing malware used for cyber espionage. It is capable of capturing screenshots, collecting files, extracting data from removable USB drives, and stealing credentials from web browsers and messaging applications. It leverages the legitimate SyncThing software for data exfiltration.
Information stealer used in espionage campaigns, capable of stealing files, credentials, screenshots, and data from messaging applications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.