Malware › Module 2 › Lesson 3
Spyware APT Named
Name spyware and APT concepts for detection literacy — persistence, exfil, long dwell — samples only on $MAL_LAB from legal sources.
Visual · mal_spyware_apt_named
Spyware/APT named literacy. $MAL_LAB only. Original Cyberlium.
Opening
Spyware steals secrets; APT groups operate long campaigns — analysts name behaviors for hunting, not replication.
Spyware covertly collects keystrokes, screenshots, credentials, or audio. Advanced Persistent Threat (APT) actors combine stealth, custom tooling, and long dwell time against high-value targets — mapped in ATT&CK groups and vendor reports. Defenders hunt persistence, unusual egress, and credential access chains. Cyberlium teaches naming and report literacy for $MAL_LAB notes. You will NOT build spyware, keyloggers for strangers, or replicate APT campaigns against unauthorized targets. Next: Families Lab.
1. Spyware: covert collection
Spyware indicators: hooking APIs, unexpected microphone/camera access, browser credential dumps, exfil to rare domains. Consumer 'stalkerware' and enterprise infostealers share collection goals — defenders block exfil and remove persistence.
Analysis on $MAL_LAB labels collection modules in static strings or dynamic procmon — never deploy against real users.
Command guide
Try these commands — Spyware: covert collection
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide (defender playbook) MalwareBazaar tags — https://bazaar.abuse.ch/browse/ (family tag literacy — do not bulk-download)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.cisa.gov/stopransomware/ransomware-guide | head -10 curl -sS https://bazaar.abuse.ch/browse/ | grep -oiE 'ransomware|trojan|worm' | sort | uniq -c | head -6
Primary tools to practice this lesson: curl, jq. Reference sites: CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); MalwareBazaar tags (https://bazaar.abuse.ch/browse/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. APT: named groups and TTP chains
APT reports name groups (e.g., ATT&CK Gxxxx) with TTP sequences — spearphish, custom malware, lateral movement, data staging. Literacy means reading reports for detection gaps, not copying campaigns against classmates or employers without engagement.
Map report TTPs to YOUR $MAL_LAB detection wishlist — technique ID, log source, gap Y/N.
3. Named for hunt — not for harm
Forbidden: keylogger deployment, stalkerware, APT playbooks against production, or 'long dwell' on unauthorized networks. Allowed: family/spyware/APT vocabulary in analysis reports with IOC hygiene.
Ship: spyware vs APT one-liner + three ATT&CK technique IDs you'd hunt on $MAL_LAB SIEM fixture. Next: Families Lab.
4. What you ship: spyware/APT literacy note for $MAL_LAB
Spyware vs APT definitions. Three hunt technique IDs. NEVER keyloggers/stalkerware. chmod 600.
5. What you record before the next lesson
Date. Spyware/APT note. Three technique IDs. File t22-m02-l03-spyware-apt-named.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy keylogger on classmate 'for APT lab.' Copy full APT chain to production.
Right
Write spyware/APT literacy note with hunt IDs. Next: Families Lab.
Mission: name spyware and APT for hunting
1) Define spyware and APT in one sentence each. 2) List three ATT&CK IDs to hunt. 3) Write NEVER keylogger/stalkerware line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Reports give TTP names — your job is detection mapping.
Knowledge Check
APPLY: Spyware/APT Named on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: APT reports should be copied as attack plans against unauthorized networks.
True or False
Knowledge Check
APPLY: Unexpected credential dumping + rare domain egress suggests:
Multiple choice