# TeamSpy Crew: threat group profile

> TeamSpy Crew is an espionage group thought to operate from Russia, with suspected state backing. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/teamspy-crew
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > TeamSpy Crew

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 2 |
| Thought to operate from | Russia |
| Suspected backing | Russia |
| Motive | Espionage |
| Other names | 4 |
| Public reports | 6 |

## Who is TeamSpy Crew?

TeamSpy Crew is an espionage group thought to operate from Russia, with suspected state backing. Public reporting about it is still limited.

### Also known as

TeamSpy, Team Bear, Anger Bear, IRON LYRIC

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political activists. Known as the TeamSpy crew because of its affinity for using the legitimate TeamViewer application as part of its toolset, the attackers may have been active for as long as 10 years, researchers say. The attack appears to be a years-long espionage campaign, but experts who have analyzed the victim profile, malware components and command-and-control infrastructure say that it’s not entirely clear what kind of data the attackers are going after. What is clear, though, is that the attackers have been at this for a long time and that they have specific people in mind as targets. Researchers at the CrySyS Lab in Hungary were alerted by the Hungarian National Security Authority to an attack against a high-profile target in the country and began looking into the campaign. They quickly discovered that some of the infrastructure being used in the attack had been in use for some time and that the target they were investigating was by no means the only one.

## Who does TeamSpy Crew go after?

**Sectors:** Government, Private sector

**Countries and victims named:** Hungary, Belarus

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about TeamSpy Crew

- https://securelist.com/blog/incidents/35520/the-teamspy-crew-attacks-abusing-teamviewer-for-cyberespionage-8/
- https://www.cfr.org/interactive/cyber-operations/team-spy-crew
- https://threatpost.com/researchers-uncover-teamspy-attack-campaign-targeting-government-research-targets-032013/77646/
- https://www.crysys.hu/publications/files/teamspy.pdf
- https://d2538mqrb7brka.cloudfront.net/wp-content/uploads/sites/43/2018/03/20134928/theteamspystory_final_t2.pdf
- https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector

## Frequently asked questions

### Who is TeamSpy Crew?

TeamSpy Crew is an espionage group thought to operate from Russia, with suspected state backing. Public reporting about it is still limited.

### Where is TeamSpy Crew thought to be based?

Public reporting places TeamSpy Crew as operating from Russia, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does TeamSpy Crew target?

In public reporting, sectors named include government and private sector, and 2 countries and victims are named, including Hungary and Belarus.

### How do I know if TeamSpy Crew is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact