KEYPLUG

MITRE ATT&CK: S1051 View on attack.mitre.org

Aliases: KEYPLUG.LINUX, ELFSHELF, KEYPLUG

First seen
2021-06-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
linux, windows
Profile updated
2026-07-07 13:04:08

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:cn

Context

KEYPLUG is a modular backdoor written in C++, with Windows and Linux variants, that has been used by APT41 since at least June 2021.

Detection coverage

  • 1 YARA rules
  • 76 Sigma rules

Malware & tools used

  • Web Protocols (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Dead Drop Resolver (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Proxy (attack-pattern)
  • Non-Application Layer Protocol (attack-pattern)

Used by threat actors

  • C0017 (campaign)
  • RedGolf (threat-actor)
  • APT41 (threat-actor)

Detection rules

  • SEKOIA_Apt_Apt41_Keyplug_Dropper (yara-rule)

Reports & references

  • i.blackhat.com — As 22 Leonsilvia Nextgenplugxshadowpad (report)
  • go.recordedfuture.com — Cta 2023 0330 (report)
  • malpedia.caad.fkie.fraunhofer.de — Elf.Keyplug (report)
  • hunt.io — Keyplug Infrastructure Tls Certificates Ghostwolf Activity (report)
  • web.archive.org — Uncovering An Undetected Keyplug Implant Attacking Industries In Italy (report)
  • Mandiant — Mobileiron Log4Shell Exploitation (report)
  • sentinelone.com — Sandman Apt China Based Adversaries Embrace Lua (report)
  • virusbulletin.com — Down The Grayrabbit Hole Exposing Unc3569 And Its Modus Operandi (report)
  • Mandiant — 1 (report)
  • twitter.com — 1501290277864046595 (report)
  • Mandiant — Apt41 Us State Governments (report)
  • MITRE ATT&CK — S1051 (report)

External references