APT / THREAT GROUP

SpyGrace

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A backdoor, capable of providing shell access, loading additional payloads, interacting remotely with the file system and processes, and taking screenshots.

Threat Analysis

SpyGrace is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blogs.jpcert.or.jp/en/2024/12/APT-C-60.html

→https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea

→https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-spy-group-exploits-wps-office-zero-day-analysis-uncovers-a-second-vulnerability/

→https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

SpyGlacewin.spygraceSpyGrace

External Intelligence

Malpedia: win.spygrace

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SpyGrace