Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 21:26:55 UTC
Home > List all groups > List all tools > List all groups using tool WhiskerSpy
 Tool: WhiskerSpy
Names WhiskerSpy
Category Malware
Type Backdoor
Description
(Trend Micro) When a targeted visitor tries to watch videos on the website, a malicious script
injected by the attacker displays a message prompt notifying the victims with a video codec
error to entice them to download and install a trojanized codec installer. The installer was
patched to load a previously unseen backdoor, that we dubbed “WhiskerSpy.”
Information
<https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-backdoor.html>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/win.whiskerspy>
Last change to this tool card: 22 June 2023
Download this tool card in JSON format
All groups using tool WhiskerSpy
Changed Name Country Observed
APT groups
  Operation Earth Kitsune 2019-Late 2022  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=34768536-85c9-4abe-ab65-a3ccd2c9654e
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=34768536-85c9-4abe-ab65-a3ccd2c9654e
Page 1 of 1