Security Resilience

Threat actor · all actors

TeamSpy CrewMISP-82c1c7fa state

🇷🇺 RU

aka TeamSpy Crew, TeamSpy, Team Bear, Anger Bear, IRON LYRIC

Last updated: 2026-10-16

5attributed CVEs
0ATT&CK techniques
9.1IDF score (tooling uniqueness)
0exclusive CVEs
2019–2022years active

About this actor

Researchers have uncovered a long-term cyber-espionage campaign that used a combination of legitimate software packages and commodity malware tools to target a variety of heavy industry, government intelligence agencies and political activists. Known as the TeamSpy crew because of its affinity for using the legitimate TeamViewer application as part of its toolset, the attackers may have been active for as long as 10 years, researchers say. The attack appears to be a years-long espionage campaign, but experts who have analyzed the victim profile, malware components and command-and-control infrastructure say that it’s not entirely clear what kind of data the attackers are going after. What is clear, though, is that the attackers have been at this for a long time and that they have specific people in mind as targets. Researchers at the CrySyS Lab in Hungary were alerted by the Hungarian National Security Authority to an attack against a high-profile target in the country and began looking into the campaign. They quickly discovered that some of the infrastructure being used in the attack had been in use for some time and that the target they were investigating was by no means the only one.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

CrowdStrikenation-animal names

Team BearAnger Bear

Secureworkscolour-metal names

IRON LYRIC

Unclassifiedno scheme matched

TeamSpy CrewTeamSpy

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2019: 3 CVE published320192020: 2 CVE published220202021: 4 KEV added420212022: 1 KEV added12022
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-10149 KEV9.99.80.99962019-06-05see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category