Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

Researchers have identified 'Speagle', a novel malware that hijacks the Cobra DocGuard client and infrastructure to surreptitiously harvest and exfiltrate sensitive data from only systems running that software. Tracked as 'Runningcrab', Speagle likely leverages supply-chain techniques, uses legitimate DocGuard servers for C2 and exfiltration, can toggle collection features, searches for specific sensitive files (including Chinese missile-related documents), and may be the work of a state-sponsored actor or hired contractor.