TeamSpy Crew
TeamSpy Crew is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Government and Manufacturing, in 57 countries, including the United States and the United Kingdom.
- SIG39
- Iron Lyric
- Team Bear
- Anger Bear
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2010
- Record updated
Who They Target.
About TeamSpy Crew.
Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political activists. Known as the TeamSpy crew because of its affinity for using the legitimate TeamViewer application as part of its toolset, the attackers may have been active for as long as 10 years, researchers say. The attack appears to be a years-long espionage campaign, but experts who have analyzed the victim profile, malware components and command-and-control infrastructure say that it’s not entirely clear what kind of data the attackers are going after. What is clear, though, is that the attackers have been at this for a long time and that they have specific people in mind as targets. Researchers at the CrySyS Lab in Hungary were alerted by the Hungarian National Security Authority to an attack against a high-profile target in the country and began looking into the campaign.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.