Procedure examples

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.

APT3 has used a keylogging tool that records keystrokes in encrypted files.

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes. Kimsuky has also leveraged Native Windows API functions such as `GetAsyncKeyState()` along with others to capture keystrokes every 50 milliseconds and stores data in a file stored in the temp directory.

Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.

APT41 used a keylogger called GEARSHIFT on a target system.

menuPass has used key loggers to steal usernames and passwords.

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.

APT39 has used tools for capturing keystrokes.

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.

Ke3chang has used keyloggers.

Malware used by Group5 is capable of capturing keystrokes.

Darkhotel has used a keylogger.

APT28 has used tools to perform keylogging.

APT42 has used custom malware to log keystrokes.

APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.

Tonto Team has used keylogging tools in their operations.

Lazarus Group malware KiloAlfa contains keylogging functionality.

FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.

Sowbug has used keylogging tools.

HEXANE has used a PowerShell-based keylogger named `kl.ps1`.

PLATINUM has used several different keyloggers.

Magic Hound malware is capable of keylogging.

Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.

FIN13 has logged the keystrokes of victims to escalate privileges.