Procedure examples

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.

Ke3chang has used keyloggers.

Malware used by Group5 is capable of capturing keystrokes.

Darkhotel has used a keylogger.

APT28 has used tools to perform keylogging.

APT42 has used custom malware to log keystrokes.

APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.

Tonto Team has used keylogging tools in their operations.

Lazarus Group malware KiloAlfa contains keylogging functionality.

FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.

Sowbug has used keylogging tools.

HEXANE has used a PowerShell-based keylogger named `kl.ps1`.

PLATINUM has used several different keyloggers.

Magic Hound malware is capable of keylogging.

Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.

FIN13 has logged the keystrokes of victims to escalate privileges.

RCSession has the ability to capture keystrokes on a compromised host.

yty uses a keylogger plugin to gather keystrokes.

DOGCALL is capable of logging keystrokes.

PAKLOG has captured keystrokes using Windows API.

Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.

Matryoshka is capable of keylogging.

InvisibleFerret has conducted keylogging using the Python project “pyWinHook” and "Pyhook". InvisibleFerret has also captured keylogging thread checks for changes in an active window and key presses.

TONESHELL has capabilities to conduct keylogging.

Kasidet has the ability to initiate keylogging.

AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.

NETWIRE can perform keylogging.

BOOKWORM has used its KBLogger.dll module to capture keystrokes and stored them in a folder.

CosmicDuke uses a keylogger.

EvilGrab has the capability to capture keystrokes.

SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.

GreyEnergy has a module to harvest pressed keystrokes.

Crimson can use a module to perform keylogging on compromised hosts.

DUSTTRAP can perform keylogging operations.

Machete logs keystrokes from the victim’s machine.

PowerLess can use a module to log keystrokes.

Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.

HexEval Loader has utilized a cross-platform keylogger that has the capability to capture keystrokes on Windows, macOS and Linux systems.

FlawedAmmyy can collect keyboard events.

InvisiMole can capture keystrokes on a compromised host.

Okrum was seen using a keylogger tool to capture keystrokes.

Regin contains a keylogger.

Mispadu can log keystrokes on the victim's machine.

Fysbis can perform keylogging.

VERMIN collects keystrokes from the victim machine.

MarkiRAT can capture all keystrokes on a compromised host.

NavRAT logs the keystrokes on the targeted system.

DarkComet has a keylogging capability.

CHIMNEYSWEEP has the ability to support keylogging.