Malware: KEYPLUG

Description

[KEYPLUG](https://attack.mitre.org/software/S1051) is a modular backdoor written in C++, with Windows and Linux variants, that has been used by [APT41](https://attack.mitre.org/groups/G0096) since at least June 2021.(Citation: Mandiant APT41)

External References

• mitre-attack
• Mandiant APT41

Techniques Used by This Malware

• T1027.013 — Encrypted/Encoded File
• T1071.001 — Web Protocols
• T1090 — Proxy
• T1095 — Non-Application Layer Protocol
• T1102.001 — Dead Drop Resolver
• T1124 — System Time Discovery
• T1140 — Deobfuscate/Decode Files or Information
• T1573.002 — Asymmetric Cryptography

APT Groups Using This Malware

• APT41