What is Spyware?
Spyware is a type of malware that is secretly installed on a system to collect information without the knowledge or consent of the user or organisation and pass it on to an attacker. Its aim is usually to spy on user activity, steal sensitive data such as passwords and documents, or monitor behaviour for commercial, criminal or state purposes. Unlike ransomware, spyware deliberately tries not to be noticed: the longer an infection goes undetected, the more information the attacker harvests. In industrial environments the target is not just personal data, but also process data, recipes, PLC programs and network drawings that make a later attack on production possible.
🧠 What exactly does spyware do?
Spyware can, among other things:
- Record keystrokes (keylogging) - passwords, messages and search queries are captured character by character
- Collect credentials and financial data - saved browser passwords, session cookies, credit card details and VPN profiles
- Track browsing behaviour and history - often for advertising or profiling purposes
- Take screenshots or switch on the microphone and webcam
- Search for and exfiltrate files - documents, emails and project files
- In industrial environments, forward information about processes and devices - for example an inventory of OPC servers and tags, or a copy of the control logic
The US standards body NIST describes spyware as software that is secretly or surreptitiously installed on a system to gather information about individuals or organisations without their knowledge, and explicitly classes it as malicious code.
🔧 What types of spyware are there?
Spyware is not a single program but a family of techniques. A single infection often combines several of them.
| Type | What it does | Typical target |
|---|---|---|
| Keylogger | Captures keystrokes | Passwords of administrators and engineers |
| Infostealer | Grabs saved passwords, cookies and wallets in one go | Home and office workstations, credentials for remote access |
| Remote Access Trojan (RAT) | Gives the attacker remote access, including screen capture and file transfer | Workstations in the office or OT network |
| Screen grabber | Takes periodic screenshots | HMI and engineering screens |
| Adware and trackers | Follows browsing behaviour for advertising | Consumers, sometimes bundled with “free” software |
| Commercial or state spyware | Takes full control of a smartphone, often through unknown vulnerabilities | Journalists, executives, politicians |
Commercial spyware such as Pegasus from NSO Group has caused political controversy in Europe. A European Parliament committee of inquiry (PEGA) adopted its final report on the abuse of such software in several member states on 8 May 2023.
🛠️ How does spyware reach a system?
- Via infected downloads or software installations
- Through malicious email attachments or links, see phishing
- Bundled as “free” tools or apps that quietly collect data
- Via external media such as USB sticks, see USB Control
- Through tampered vendor software or updates, a form of supply chain risk
- In combination with other malware, such as a trojan or virus that later pulls in the spyware
🏭 What risks does spyware pose to industrial (OT) environments?
In environments with PLCs, SCADA, RTUs and other industrial components, spyware can:
- Leak process information and recipes to competitors or state actors
- Quietly copy configuration data, PLC programs or setpoints
- Steal passwords for an engineering station or historian
- Act as a precursor to targeted attacks such as sabotage or ransomware, which can ultimately affect safety
- Compromise the confidentiality and integrity of production data
The MITRE ATT&CK for ICS framework describes this as the Collection (TA0100) tactic: attackers gather knowledge about the installation to prepare their attack. Techniques include Program Upload (T0845, reading the control logic out of a controller), Screen Capture (T0852), Point & Tag Identification (T0861) and Data from Information Repositories (T0811), for example emptying a documentation server.
🕰️ Which known espionage campaigns have hit industry?
Espionage often precedes sabotage. The following campaigns show how spyware operates in industrial environments:
| Campaign | Period | What happened |
|---|---|---|
| Duqu | 2011 | Discovered by the Hungarian CrySyS Lab; code base nearly identical to Stuxnet, but built for espionage with a keylogger, screenshots and file collection |
| Flame | 2012 | Extensive espionage toolkit with features including audio recording and screenshots |
| Havex (Dragonfly) | 2013-2014 | Remote access trojan spread via phishing, compromised websites and tampered installers from ICS vendors; a module searched the network for OPC Classic servers and tags |
| BlackEnergy | 2014-2015 | Extensible malware with reconnaissance plugins, used in the run-up to the power outage in Ukraine |
The Havex module could not control equipment, but the US ICS-CERT found in testing that its scanning sometimes caused OPC servers to crash. Even “just looking” can therefore cause disruption in OT.
🔍 How do you recognise spyware?
Targeted spyware rarely shows visible symptoms; detection mostly happens in the network. Possible signals:
| Signal | Where you see it | Why it is suspicious |
|---|---|---|
| Outbound traffic to unknown domains | DNS monitoring, firewall logs | Spyware sends data to a command-and-control server |
| An OT system talking to the internet | network monitoring | PLCs, HMIs and historians should not have internet access |
| Unexpected program uploads from a PLC | Controller logs, OT IDS | May indicate copying of control logic |
| New processes or startup items | EDR, antivirus | Spyware embeds itself to survive a reboot |
| Slow performance or unusual data usage | Users, administrator | Mainly with less sophisticated spyware and adware |
| Changed browser settings or home page | Users | Typical of adware and trackers |
Compare any file hashes, domains and IP addresses you find with known indicators of compromise from threat intelligence published by, for example, the NCSC.
🔐 How do you protect against spyware?
- Endpoint protection - use antivirus/anti-malware software with real-time detection or EDR; on OT systems where that is not possible, application whitelisting is often a better fit
- Install only trusted software - check signatures and hashes of vendor software before installing it in OT
- Updates and patches - apply them regularly through a patch management process
- Restrict internet access on critical systems and block outbound traffic by default
- Segment - implement network segmentation and the zones and conduits model from IEC 62443, so an infected office workstation cannot reach the OT zone
- Limit the privileges of users and services to the minimum according to least privilege
- Train staff through security awareness to recognise phishing
🇳🇱 What should you do after an infection in the Netherlands?
A practical approach to a suspected spyware infection:
- Isolate the system from the network, but do not switch it off straight away: memory and logs are valuable for forensic investigation
- Determine the scope - which accounts, passwords and files were reachable from the system, and did it communicate with other systems?
- Change passwords from a clean system, starting with administrator and engineering accounts, and enable MFA where possible
- Reinstall the system from a trusted source rather than just cleaning it
- Report the incident: if your organisation falls under the Cybersecurity Act (in force since 15 August 2026), the reporting obligation of 24 hours, 72 hours and one month applies. If personal data was stolen, report the data breach under the AVG (the Dutch name for the GDPR) to the Dutch Data Protection Authority within 72 hours
- Learn - feed the findings back into your incident response plan
❓ Frequently asked questions
Is spyware the same as a virus?
No, spyware and viruses are both forms of malware, but they have different goals. A virus spreads by attaching itself to files, whereas spyware quietly collects information. Spyware can, however, be delivered by a virus or trojan.
Can spyware infect a PLC?
Spyware almost always runs on Windows systems such as engineering stations, HMIs and historians, not on the PLC itself. From such a system, however, spyware can read out PLC programs, tags and setpoints. That is why protecting engineering stations matters as much as protecting the controller.
Why is spyware dangerous if nothing breaks?
Spyware gives attackers the knowledge for a later, targeted attack: passwords, network drawings and control logic. Campaigns such as Duqu and Havex collected exactly that kind of information. Theft of recipes and process data can also cost a company its competitive advantage.
Is antivirus enough to stop spyware?
Antivirus catches known spyware well, but targeted spyware is often new and then goes unnoticed. Combine endpoint protection with network monitoring, segmentation and restrictions on outbound traffic. In OT environments, application whitelisting is often more effective than classic antivirus.
How long does spyware usually go undetected?
Spyware is designed to stay invisible for as long as possible, and targeted espionage campaigns often run for months or years. The group behind Havex (Dragonfly), for example, had been active since at least 2011, while the ICS-focused Havex module was only publicly described in June 2014. Continuous network monitoring shortens that period considerably.
Do I have to report a spyware infection?
If your organisation falls under the Dutch Cybersecurity Act and the incident is significant, you must report it to the CSIRT with an early warning within 24 hours. If personal data has leaked, you report that data breach to the Dutch Data Protection Authority within 72 hours. Even without an obligation, you can inform the NCSC.
📌 In summary
Spyware is a silent threat that intercepts sensitive data without users noticing, and in industrial environments it is often the reconnaissance phase of a later attack.
In both IT and OT systems, spyware can have a serious impact on privacy, security and business continuity. Endpoint protection alone is not enough: segmentation, restricted outbound traffic, network monitoring and a rehearsed incident response process make the difference.