Threat Actor
Runningcrab
- First Reported
- Mar 19, 2026
- Latest Reported
- Mar 20, 2026
Reported Context (3)
- Researchers attributed the Speagle campaign to this previously unknown threat actor. They believe it was likely the work of a state-sponsored group or hired contractor; the exact infection method is unknown. Cybersecurity Roundup: KVM Flaws, Speagle Malware, Operation Alice and More
- The article uses Runningcrab as the tracking name for activity involving Speagle. The responsible actor is unattributed; researchers consider a state-sponsored actor or hired private contractor possible. Speagle Malware Abuses Cobra DocGuard to Steal Data
- The researchers assigned this name to the actor behind Speagle, while stating they could not associate it with a known threat actor. The actor's identity and whether it is state-sponsored or a private contractor remain uncertain. Researchers Detail Speagle Infostealer’s Abuse of Cobra DocGuard
CVE (1)
Malware (4)
People (2)
Threat Actors (3)
MITRE ATT&CK (9)
Vendors (5)
Products (7)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.