MalwareUsed by 2 actors

FastSpy

FastSpy is an Android remote access tool associated with the North Korean espionage group Kimsuky. It is derived from the open-source AndroSpy codebase and has been used in mobile intrusion activity targeting South Korean victims. FastSpy has been observed as a second-stage payload in an infection chain involving the trojanized FastViewer application, which impersonates a legitimate Android document viewer. In that chain, FastViewer activates malicious behavior when a victim opens an attacker-crafted document, collects device information, and then downloads and executes FastSpy in memory.

FastSpy functions as a remote access capability for Android devices and communicates with attacker-controlled infrastructure over TCP/IP to receive commands. Its role in Kimsuky operations reflects the group’s expansion of long-running espionage tradecraft from desktop-focused spearphishing into Android mobile surveillance and post-compromise access. Reported activity places FastSpy within a broader cluster of Kimsuky mobile malware that also includes FastFire and FastViewer, indicating sustained investment in Android tooling for intelligence collection against targets of interest to the DPRK, particularly in South Korea.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

FastSpy is a remote access tool based on AndroSpy. ... The FastViewer malware downloads FastSpy, and receives commands from the attacker’s server through TCP/IP protocol.

via medium s2wblogmedium.com

Nickel Kimball

Tools BabyShark, KONNI, FastFire, FireViewer, FastSpy, ReconShark, KimJongRAT, Kimsuky

via secureworks threat profilessecureworks.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

"...using typosquatting or domains thematically aligned with their target."

Initial Access

2 techniques

T1566PhishingEvidence2

The group mainly attempts to collect by distributing malware and taking over accounts through spear-phishing attacks.

T1566.001Spearphishing AttachmentEvidence1

"...often involves malicious Hangul Word Processing (HWP) documents as a delivery mechanism... evolved its capabilities to include... Microsoft Word and PDF documents."

Stealth

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

For instance, Kimsuky was recently observed using an IP validation method as part of its GoldDragon infection mechanism. The same Intrusion Set also newly implemented a geofencing mechanism in their signature malware Konni RAT, and similar behaviour was observed in the FastSpy infection chain.

T1620Reflective Code LoadingEvidence1

FastViewer additionally downloads FastSpy malware and executes it in memory to perform additional malicious actions.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1614System Location DiscoveryEvidence1

The same Intrusion Set also newly implemented a geofencing mechanism in their signature malware Konni RAT, and similar behaviour was observed in the FastSpy infection chain.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

FastViewer additionally downloads FastSpy malware and executes it in memory to perform additional malicious actions.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

medium s2wblogNews

Mar 21, 2023

Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware | by S2W | S2W BLOG | Medium

Android remote access malware used as a secondary payload. It is based on AndroSpy and provides attacker command-and-control over infected devices via TCP/IP.

sekoia blogNews

Dec 16, 2022

The DPRK delicate sound of cyber - Sekoia.io Blog

Android malware/infection chain associated with Kimsuky exhibiting geofencing-like behavior.

secureworks threat profilesNews

Mar 18, 2026

NICKEL KIMBALL

Tools BabyShark, KONNI, FastFire, FireViewer, FastSpy, ReconShark, KimJongRAT, Kimsuky

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FastSpy