New Infostealer Malware Targets Cobra DocGuard Users

• •Infostealer.Speagle targets users of Cobra DocGuard software for data exfiltration.
• •The malware is linked to a compromised Cobra DocGuard server, masking its activities.
• •Current infection vector is unknown, but may involve a supply chain attack.

Researchers from Symantec and Carbon Black have identified a new malware strain, Infostealer.Speagle, which compromises the Cobra DocGuard security software to exfiltrate sensitive information. This malware specifically targets computers with Cobra DocGuard installed, indicating a focus on intelligence collection or industrial espionage, particularly concerning documents related to Chinese ballistic missiles. The malware operates by hijacking a compromised Cobra DocGuard server, disguising its data exfiltration as legitimate traffic. Previous attacks on Cobra DocGuard include supply chain attacks reported in May 2023 and August 2023. The infection vector for Speagle is currently unknown, but there are indications it may have been distributed via a supply chain attack. The malware includes a self-delete function that utilizes a legitimate Cobra DocGuard driver, suggesting it could have been delivered through a Trojanized update. The threat actor behind Speagle has been named Runningcrab, but no direct attribution to known groups has been established. The situation remains under investigation as researchers continue to analyze the malware's behavior.