Infostealer.Speagle — Supply Chain Compromise via Cobra DocGuard Targeting Ballistic Missile Intelligence — Threadlinqs Intelligence
As of 2026-05-30, Infostealer.Speagle — Supply Chain Compromise via Cobra DocGuard Targeting Ballistic Missile Intelligence is a critical-severity malware threat attributed to Runningcrab (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0249 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Attribution: Runningcrab · China · ESPIONAGE
A novel .NET infostealer dubbed Speagle, attributed to threat actor Runningcrab, parasitically leverages Cobra DocGuard document security software for C2 communication, persistence, and self-deletion.
Infostealer.Speagle is a 32-bit .NET executable that represents a sophisticated parasitic threat targeting organizations running EsafeNet's Cobra DocGuard document security software. The malware was discovered by Broadcom/Symantec researchers and attributed to a previously undocumented threat actor tracked as Runningcrab.
Speagle operates in three distinct collection phases. In Phase 1 (System Identification), it constructs an ErrorReport structure containing the Windows username, computer hostname, and Cobra DocGuard client identifiers extracted from UniqueClientCode.ini (ClientIDID) and PackageInfo.ini (No= value). In Phase 2 (System Enumeration), it performs extensive WMI queries across three scopes: root\cimv2 (targeting 13 classes including Win32_Account, Win32_Process, Win32_Service, Win32_Share, Win32_Timezone), root\Microsoft\Windows\TaskScheduler (MSFT_ScheduledTask), and root\StandardCimv2 (network and firewall rules). It also enumerates directories to depth 2 (excluding Windows, Users, PerfLogs, System Volume Information, $Recycle.Bin) and user profile folders to depth 5 (Documents, Downloads, Desktop, AppData). In Phase 3 (Browser and Credential Theft), it searches AppData for browser databases containing History, Web Data, and Login Data files, executing SQLite queries to extract URLs, autofill data, downloads, omnibox shortcuts, and bookmarks.
A particularly notable variant (SHA256: dcd3f06093bf34d81837d837c5a5935beb859ba6258e5a80c3a5f95638a13d4d) includes functionality to search for documents related to Chinese ballistic missiles, specifically the Dongfeng-27 (CSS-X-24). Keywords include ballistic missile, cruise missile, Dongfeng, Changjian, supersonic, hypersonic, thermal protection, warhead, aerospace, antenna, nozzle, ceramic, and composite. This strongly indicates state-level intelligence collection objectives, likely by a nation-state adversary or private contractor operating on behalf of a government.
For C2 communication, Speagle masquerades its traffic as legitimate Cobra DocGuard client-server communication by sending HTTP POST requests to compromised Cobra DocGuard servers at the CDGServer3/CDGClientDiagnostics endpoint with flag=syn_user_policy parameter. The malware uses a distinctive User-Agent string 'Raw HTML Reader' and custom HTTP headers (X-Request-Name, X-Request-ID, X-Request-No, X-Request-Time). Data is serialized as XML, compressed via Deflate, encrypted with AES-128 CBC (PKCS#7 padding) using the first 16 bytes of SHA256('kAozqXwNES5yjGcZUlXeI4zigg68aZI4') as the key, and hexlified before transmission.
Speagle employs a two-stage self-deletion mechanism. It first attempts to leverage the Cobra DocGuard device driver by opening \\.\FileLock and sending a DeviceIoControl call with IoControlCode 0x85272220, passing its own process ID. If this fails, it falls back to a file-based technique: renaming its executable to 6 random uppercase letters and calling SetFileInformationByHandle with FileDispositionInfo to set the DeleteFile flag.
This threat represents the second known exploitation of Cobra DocGuard infrastructure, following the Carderbee APT campaign in 2023 that used the same software to deliver PlugX/Korplug backdoors to organizations in Hong Kong. While no direct link between Runningcrab and Carderbee has been established, the deliberate targeting of Cobra DocGuard infrastructure suggests the developer had detailed knowledge of prior supply chain vulnerabilities in EsafeNet products. Cobra DocGuard is produced by EsafeNet, a subsidiary of Chinese information security firm NSFOCUS.
Weaknesses (CWE)
CWE-506, CWE-319, CWE-522
Target sectors: defense, government, military, aerospace, technology, manufacturing
Target regions: East Asia, China, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1195, T1047, T1547, T1036, T1070, T1027, T1140, T1555, T1082, T1083