KEYPLUG

Malware & Tools · KEYPLUG

· MalwareS1051 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Linux, Windows

Description

KEYPLUG is a modular backdoor written in C++, with Windows and Linux variants, that has been used by APT41 since at least June 2021.(Citation: Mandiant APT41)

Tactic Coverage

command and control (5)stealth (2)discovery (1)

Used By (1 groups)

G0096APT41Wicked Panda, Brass Typhoon

Techniques (8)

T1027.013Encrypted/Encoded File

stealth

T1071.001Web Protocols

command and control

T1090Proxy

command and control

T1095Non-Application Layer Protocol

command and control

T1102.001Dead Drop Resolver

command and control

T1124System Time Discovery

discovery

T1140

References

https://attack.mitre.org/software/S1051 https://www.mandiant.com/resources/apt41-us-state-governments