KeyBoy

Malware & Tools · KeyBoy

· MalwareS0387 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

KeyBoy is malware that has been used in targeted campaigns against members of the Tibetan Parliament in 2016.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: PWC KeyBoys Feb 2017)

Tactic Coverage

execution (5)discovery (3)stealth (3)command and control (2)collection (2)credential access (2)persistence (2)privilege escalation (2)

Used By (1 groups)

G0081Tropic TrooperPirate Panda, KeyBoy

Techniques (18)

T1001.003Protocol or Service Impersonation

command and control

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1056.001Keylogging

collectioncredential access

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

References

https://attack.mitre.org/software/S0387 https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/https://citizenlab.ca/2016/11/parliament-keyboy/https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html