ATT&CK SoftwareKEYPLUG

KEYPLUG

S1051

Malware.View on attack.mitre.org

About this malware

KEYPLUG is a modular backdoor written in C++, with Windows and Linux variants, that has been used by APT41 since at least June 2021.

Techniques used8

Stealth2

T1027.013Encrypted/Encoded File T1140Deobfuscate/Decode Files or Information

Discovery1

T1124System Time Discovery

Command and Control5

T1071.001Web Protocols T1090Proxy T1095Non-Application Layer Protocol T1102.001Dead Drop Resolver T1573.002Asymmetric Cryptography

Procedure examples8

Technique	Procedure example
T1027.013 Encrypted/Encoded File	KEYPLUG can use a hardcoded one-byte XOR encoded configuration file. Mandiant APT41
T1071.001 Web Protocols	KEYPLUG has the ability to communicate over HTTP and WebSocket Protocol (WSS) for C2. Mandiant APT41
T1090 Proxy	KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains. Mandiant APT41
T1095 Non-Application Layer Protocol	KEYPLUG can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication. Mandiant APT41
T1102.001 Dead Drop Resolver	The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums. Mandiant APT41
T1124 System Time Discovery	KEYPLUG can obtain the current tick count of an infected computer. Mandiant APT41
T1140 Deobfuscate/Decode Files or Information	KEYPLUG can decode its configuration file to determine C2 protocols. Mandiant APT41
T1573.002 Asymmetric Cryptography	KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2. Mandiant APT41

Groups that use it1

Campaigns1

References1

Mandiant APT41 Open source
Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.