Skip to content

T1056.001 Keylogging

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.1

Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.3 Some methods include:

  • Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.
  • Reading raw keystroke data from the hardware buffer.
  • Windows Registry modifications.
  • Custom drivers.
  • Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.2
Item Value
ID T1056.001
Sub-techniques T1056.001, T1056.002, T1056.003, T1056.004
Tactics TA0009, TA0006
Platforms Linux, Network Devices, Windows, macOS
Version 1.3
Created 11 February 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
C0028 2015 Ukraine Electric Power Attack During the 2015 Ukraine Electric Power Attack, Sandworm Team gathered account credentials via a BlackEnergy keylogger plugin. 211212
S0045 ADVSTORESHELL ADVSTORESHELL can perform keylogging.2728
S0331 Agent Tesla Agent Tesla can log keystrokes on the victim’s machine.116117118119120
G0130 Ajax Security Team Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.179
S0622 AppleSeed AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.8182
G0007 APT28 APT28 has used tools to perform keylogging.180124181
G0022 APT3 APT3 has used a keylogging tool that records keystrokes in encrypted files.206
G0050 APT32 APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.205
G0082 APT38 APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.177
G0087 APT39 APT39 has used tools for capturing keystrokes.175176
G0096 APT41 APT41 used a keylogger called GEARSHIFT on a target system.171
G1044 APT42 APT42 has used custom malware to log keystrokes.201
G1023 APT5 APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.184185
S0373 Astaroth Astaroth logs keystrokes from the victim’s machine. 102
S1087 AsyncRAT AsyncRAT can capture keystrokes on the victim’s machine.16
S0438 Attor One of Attor’s plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.138
S0414 BabyShark BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.62
S0128 BADNEWS When it first starts, BADNEWS spawns a new thread to log keystrokes.646566
S0337 BadPatch BadPatch has a keylogging capability.87
S0234 Bandook Bandook contains keylogging capabilities.56
S0017 BISCUIT BISCUIT can capture keystrokes.163
S0089 BlackEnergy BlackEnergy has run a keylogger plug-in on a victim.142
S1226 BOOKWORM BOOKWORM has used its KBLogger.dll module to capture keystrokes and stored them in a folder. 121
S0454 Cadelspy Cadelspy has the ability to log keystrokes on the compromised host.44
S0030 Carbanak Carbanak logs key strokes for configured processes and sends them back to the C2 server.113114
S0348 Cardinal RAT Cardinal RAT can log keystrokes.72
S0261 Catchamas Catchamas collects keystrokes from the victim’s machine.47
S1149 CHIMNEYSWEEP CHIMNEYSWEEP has the ability to support keylogging.127
S0023 CHOPSTICK CHOPSTICK is capable of performing keylogging.12327124
S0660 Clambling Clambling can capture keystrokes on a compromised host.91126
S0154 Cobalt Strike Cobalt Strike can track key presses with a keylogger module.484950
S0338 Cobian RAT Cobian RAT has a feature to perform keylogging on the victim’s machine.115
S1235 CorKLOG CorKLOG has captured keystrokes.71
S0050 CosmicDuke CosmicDuke uses a keylogger.101
S0115 Crimson Crimson can use a module to perform keylogging on compromised hosts.198485
S0625 Cuba Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.89
C0029 Cutting Edge During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.213
S0334 DarkComet DarkComet has a keylogging capability.160
S1111 DarkGate DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.108109
G0012 Darkhotel Darkhotel has used a keylogger.182
S1066 DarkTortilla DarkTortilla can download a keylogging module.110
S0673 DarkWatchman DarkWatchman can track key presses with a keylogger module.161
S0187 Daserf Daserf can log keystrokes.156157
S0021 Derusbi Derusbi is capable of logging keystrokes.17
S0213 DOGCALL DOGCALL is capable of logging keystrokes.7677
S0567 Dtrack Dtrack’s dropper contains a keylogging executable.46
S0038 Duqu Duqu can track key presses with a keylogger module.22
S1159 DUSTTRAP DUSTTRAP can perform keylogging operations.54
S0062 DustySky DustySky contains a keylogger.86
S0593 ECCENTRICBANDWAGON ECCENTRICBANDWAGON can capture and store keystrokes.143
S0363 Empire Empire includes keylogging capabilities for Windows, Linux, and macOS systems.4
S0152 EvilGrab EvilGrab has the capability to capture keystrokes.32
S0569 Explosive Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.7980
S0076 FakeM FakeM contains a keylogger module.146
G1016 FIN13 FIN13 has logged the keystrokes of victims to escalate privileges.207
G0085 FIN4 FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.192191
S0381 FlawedAmmyy FlawedAmmyy can collect keyboard events.41
S1044 FunnyDream The FunnyDream Keyrecord component can capture keystrokes.11
S0410 Fysbis Fysbis can perform keylogging.36
S0032 gh0st RAT gh0st RAT has a keylogger.144145
S0531 Grandoreiro Grandoreiro can log keystrokes on the victim’s machine.112
S0342 GreyEnergy GreyEnergy has a module to harvest pressed keystrokes.155
G0043 Group5 Malware used by Group5 is capable of capturing keystrokes.131
S0170 Helminth The executable version of Helminth has a module to log keystrokes.100
G1001 HEXANE HEXANE has used a PowerShell-based keylogger named kl.ps1.204203
S1249 HexEval Loader HexEval Loader has utilized a cross-platform keylogger that has the capability to capture keystrokes on Windows, macOS and Linux systems.45
S0070 HTTPBrowser HTTPBrowser is capable of capturing keystrokes on victims.55
S0434 Imminent Monitor Imminent Monitor has a keylogging module.7
S1245 InvisibleFerret InvisibleFerret has conducted keylogging using the Python project “pyWinHook” and “Pyhook”.939496 InvisibleFerret has also captured keylogging thread checks for changes in an active window and key presses.95
S0260 InvisiMole InvisiMole can capture keystrokes on a compromised host.74
S0201 JPIN JPIN contains a custom keylogger.106
S0283 jRAT jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.2324
S0088 Kasidet Kasidet has the ability to initiate keylogging.166
G0004 Ke3chang Ke3chang has used keyloggers.208209
S0387 KeyBoy KeyBoy installs a keylogger for intercepting credentials and keystrokes.92
S0526 KGH_SPY KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.168
G0094 Kimsuky Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.194197196195182
S0437 Kivars Kivars has the ability to initiate keylogging on the infected host.111
S0356 KONNI KONNI has the capability to perform keylogging.167
G0032 Lazarus Group Lazarus Group malware KiloAlfa contains keylogging functionality.190189
S0447 Lokibot Lokibot has the ability to capture input on the compromised host via keylogging.88
S0409 Machete Machete logs keystrokes from the victim’s machine.134135136137
S1016 MacMa MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.141140
S0282 MacSpy MacSpy captures keystrokes.133
G0059 Magic Hound Magic Hound malware is capable of keylogging.174
S0652 MarkiRAT MarkiRAT can capture all keystrokes on a compromised host.69
S0167 Matryoshka Matryoshka is capable of keylogging.3940
G0045 menuPass menuPass has used key loggers to steal usernames and passwords.183
S1059 metaMain metaMain has the ability to log keyboard events.164165
S0455 Metamorfo Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.2526
S1146 MgBot MgBot includes keylogger payloads focused on the QQ chat application.2930
S0339 Micropsia Micropsia has keylogging capabilities.34
S1122 Mispadu Mispadu can log keystrokes on the victim’s machine.979899
S0149 MoonWind MoonWind has a keylogger.31
S0336 NanoCore NanoCore can perform keylogging on the victim’s machine.132
S0247 NavRAT NavRAT logs the keystrokes on the targeted system.128
S0033 NetTraveler NetTraveler contains a keylogger.51
S0198 NETWIRE NETWIRE can perform keylogging.150147149148151
S1090 NightClub NightClub can use a plugin for keylogging.125
S0385 njRAT njRAT is capable of logging keystrokes.129130131
G0049 OilRig OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.199198200
S0439 Okrum Okrum was seen using a keylogger tool to capture keystrokes. 159
C0014 Operation Wocao During Operation Wocao, threat actors obtained the password for the victim’s password manager via a custom keylogger.210
S0072 OwaAuth OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.55
S1233 PAKLOG PAKLOG has captured keystrokes using Windows API.71
S1050 PcShare PcShare has the ability to capture keystrokes.11
S0643 Peppy Peppy can log keystrokes on compromised hosts.19
G0068 PLATINUM PLATINUM has used several different keyloggers.106
S0013 PlugX PlugX has a module for capturing keystrokes per process including window titles.60
S0428 PoetRAT PoetRAT has used a Python tool named klog.exe for keylogging.173
S0012 PoisonIvy PoisonIvy contains a keylogger.6768
S0378 PoshC2 PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.10
S1012 PowerLess PowerLess can use a module to log keystrokes.18
S0194 PowerSploit PowerSploit’s Get-Keystrokes Exfiltration module can log keystrokes.56
S0113 Prikormka Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.35
S0279 Proton Proton uses a keylogger to capture keystrokes.133
S0192 Pupy Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.12
S0650 QakBot QakBot can capture keystrokes on a compromised host.153154152
S0262 QuasarRAT QuasarRAT has a built-in keylogger.89
S0662 RCSession RCSession has the ability to capture keystrokes on a compromised host.9190
S0019 Regin Regin contains a keylogger.59
S0332 Remcos Remcos has a command for keylogging.1314
S0375 Remexi Remexi gathers and exfiltrates keystrokes from the machine.73
S0125 Remsec Remsec contains a keylogger component.5253
S0379 Revenge RAT Revenge RAT has a plugin for keylogging.3837
S0240 ROKRAT ROKRAT can use SetWindowsHookEx and GetKeyNameText to capture keystrokes.5857
S0090 Rover Rover has keylogging functionality.172
S0148 RTM RTM can record keystrokes from both the keyboard and virtual keyboard.4243
S0253 RunningRAT RunningRAT captures keystrokes and sends them back to the C2 server.78
G0034 Sandworm Team Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.193
S0692 SILENTTRINITY SILENTTRINITY has a keylogging capability.15
S0533 SLOTHFULMEDIA SLOTHFULMEDIA has a keylogging capability.61
S0649 SMOKEDHAM SMOKEDHAM can continuously capture keystrokes.103104
G0054 Sowbug Sowbug has used keylogging tools.202
S0058 SslMM SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.122
S0018 Sykipot Sykipot contains keylogging functionality to steal passwords.107
S0467 TajMahal TajMahal has the ability to capture keystrokes on an infected host.169
S0595 ThiefQuest ThiefQuest uses the CGEventTap functions to perform keylogging.70
G0027 Threat Group-3390 Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.55187188
S0004 TinyZBot TinyZBot contains keylogger functionality.158
S1239 TONESHELL TONESHELL has capabilities to conduct keylogging.75
G0131 Tonto Team Tonto Team has used keylogging tools in their operations.186
S0094 Trojan.Karagany Trojan.Karagany can capture keystrokes on a compromised host.105
S0130 Unknown Logger Unknown Logger is capable of recording keystrokes.64
S0257 VERMIN VERMIN collects keystrokes from the victim machine.63
G1017 Volt Typhoon Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.178
S0670 WarzoneRAT WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the GetAsyncKeyState Windows API.2021
S0161 XAgentOSX XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.33
S1207 XLoader XLoader can capture keystrokes from the victim machine.83
S0248 yty yty uses a keylogger plugin to gather keystrokes.139
S0330 Zeus Panda Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.162
S0412 ZxShell ZxShell has a feature to capture a remote computer’s keystrokes using a keylogger.171170

References

  1. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021. ↩↩

  2. Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020. ↩

  3. Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016. ↩

  4. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  5. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018. ↩

  6. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018. ↩

  7. Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020. ↩

  8. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018. ↩

  9. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018. ↩

  10. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  11. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022. ↩↩

  12. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  13. Bacurio, F., Salvio, J. (2017, February 14). REMCOS: A New RAT In The Wild. Retrieved November 6, 2018. ↩

  14. Brumaghin, E., Unterbrink, H. (2018, August 22). Picking Apart Remcos Botnet-In-A-Box. Retrieved November 6, 2018. ↩

  15. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  16. Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023. ↩

  17. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩

  18. Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022. ↩

  19. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. ↩↩

  20. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021. ↩

  21. Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022. ↩

  22. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015. ↩

  23. Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018. ↩

  24. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  25. Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020. ↩

  26. ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021. ↩

  27. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016. ↩↩

  28. Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017. ↩

  29. Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024. ↩

  30. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024. ↩

  31. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017. ↩

  32. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017. ↩

  33. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy’s Xagent macOS Tool. Retrieved July 12, 2017. ↩

  34. Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018. ↩

  35. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016. ↩

  36. Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis: Sofacy’s Linux Backdoor. Retrieved September 10, 2017. ↩

  37. Gannon, M. (2019, February 11). With Upgrades in Delivery and Support Infrastructure, Revenge RAT Malware is a Bigger Threat. Retrieved November 17, 2024. ↩

  38. Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019. ↩

  39. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017. ↩

  40. Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024. ↩

  41. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. ↩

  42. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. ↩

  43. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020. ↩

  44. Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019. ↩

  45. Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025. ↩

  46. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021. ↩

  47. Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved November 17, 2024. ↩

  48. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  49. Amnesty International. (2021, February 24). Vietnamese activists targeted by notorious hacking group. Retrieved March 1, 2021. ↩

  50. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  51. Kaspersky Lab’s Global Research and Analysis Team. (n.d.). The NetTraveler (aka ‘Travnet’). Retrieved November 17, 2024. ↩

  52. Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016. ↩

  53. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016. ↩

  54. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. ↩

  55. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩↩↩

  56. Galperin, E., Et al.. (2016, August 4). When Governments Attack: State Sponsored Malware Attacks Against Activists, Lawyers, and Journalists. Retrieved May 23, 2018. ↩

  57. Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021. ↩

  58. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018. ↩

  59. Kaspersky Lab’s Global Research and Analysis Team. (2014, November 24). THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKS. Retrieved December 1, 2014. ↩

  60. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018. ↩

  61. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020. ↩

  62. Lim, M.. (2019, April 26). BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat . Retrieved October 7, 2019. ↩

  63. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018. ↩

  64. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016. ↩↩

  65. Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018. ↩

  66. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. ↩

  67. FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024. ↩

  68. Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018. ↩

  69. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021. ↩

  70. Gabrielle Joyce Mabutas, Luis Magisa, Steven Du. (2020, July 17). Updates on Quickly-Evolving ThiefQuest macOS Malware. Retrieved April 26, 2021. ↩

  71. Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025. ↩↩

  72. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018. ↩

  73. Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019. ↩

  74. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  75. Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025. ↩

  76. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024. ↩

  77. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018. ↩

  78. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018. ↩

  79. Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021. ↩

  80. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  81. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  82. KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024. ↩↩

  83. Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025. ↩

  84. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. ↩

  85. N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022. ↩

  86. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016. ↩

  87. Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018. ↩

  88. Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020. ↩

  89. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. ↩

  90. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021. ↩

  91. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021. ↩↩

  92. Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019. ↩

  93. eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025. ↩

  94. Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025. ↩

  95. Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025. ↩

  96. Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025. ↩

  97. ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024. ↩

  98. Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024. ↩

  99. SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024. ↩

  100. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  101. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. ↩

  102. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024. ↩

  103. FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021. ↩

  104. FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021. ↩

  105. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020. ↩

  106. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩↩

  107. Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016. ↩

  108. Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024. ↩

  109. McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024. ↩

  110. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022. ↩

  111. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020. ↩

  112. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. ↩

  113. Kaspersky Lab’s Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018. ↩

  114. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. ↩

  115. Yadav, A., et al. (2017, August 31). Cobian RAT – A backdoored RAT. Retrieved November 13, 2018. ↩

  116. Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018. ↩

  117. The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018. ↩

  118. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018. ↩

  119. Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020. ↩

  120. Walter, J. (2020, August 10). Agent Tesla | Old RAT Uses New Tricks to Stay on Top. Retrieved December 11, 2020. ↩

  121. Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025. ↩

  122. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019. ↩

  123. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016. ↩

  124. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024. ↩↩

  125. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023. ↩

  126. Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021. ↩

  127. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024. ↩

  128. Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: “njRAT” Uncovered. Retrieved June 4, 2019. ↩

  129. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019. ↩

  130. Scott-Railton, J., et al. (2016, August 2). Group5: Syria and the Iranian Connection. Retrieved September 26, 2016. ↩↩

  131. Kasza, A., Halfpop, T. (2016, February 09). NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails. Retrieved November 9, 2018. ↩

  132. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018. ↩↩

  133. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. ↩

  134. Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019. ↩

  135. The Cylance Threat Research Team. (2017, March 22). El Machete’s Malware Attacks Cut Through LATAM. Retrieved September 13, 2019. ↩

  136. kate. (2020, September 25). APT-C-43 steals Venezuelan military secrets to provide intelligence support for the reactionaries — HpReact campaign. Retrieved November 20, 2020. ↩

  137. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020. ↩

  138. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018. ↩

  139. Stokes, P. (2021, November 15). Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma. Retrieved June 30, 2022. ↩

  140. Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022. ↩

  141. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016. ↩

  142. Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021. ↩

  143. Alintanahin, K. (2014, March 13). Kunming Attack Leads to Gh0st RAT Variant. Retrieved November 12, 2014. ↩

  144. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020. ↩

  145. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016. ↩

  146. Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018. ↩

  147. Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021. ↩

  148. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign’s Usage of Process Hollowing. Retrieved January 7, 2021. ↩

  149. McAfee. (2015, March 2). Netwire RAT Behind Recent Targeted Attacks. Retrieved February 15, 2018. ↩

  150. Proofpoint. (2020, December 2). Geofenced NetWire Campaigns. Retrieved January 7, 2021. ↩

  151. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021. ↩

  152. Sette, N. et al. (2020, June 4). Qakbot Malware Now Exfiltrating Emails for Sophisticated Thread Hijacking Attacks. Retrieved September 27, 2021. ↩

  153. Trend Micro. (2020, December 17). QAKBOT: A decade-old malware still with new tricks. Retrieved November 17, 2024. ↩

  154. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018. ↩

  155. Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017. ↩

  156. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018. ↩

  157. Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017. ↩

  158. Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020. ↩

  159. TrendMicro. (2014, September 03). DARKCOMET. Retrieved November 6, 2018. ↩

  160. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022. ↩

  161. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018. ↩

  162. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016. ↩

  163. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023. ↩

  164. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. ↩

  165. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016. ↩

  166. Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018. ↩

  167. Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020. ↩

  168. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019. ↩

  169. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  170. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩↩

  171. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016. ↩

  172. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020. ↩

  173. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017. ↩

  174. Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020. ↩

  175. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020. ↩

  176. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024. ↩

  177. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  178. Check Point Software Technologies. (2015). ROCKET KITTEN: A CAMPAIGN WITH 9 LIVES. Retrieved March 16, 2018. ↩

  179. Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015. ↩

  180. Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm’s Lack of Sophistication as a Strategy. Retrieved January 13, 2021. ↩

  181. Kaspersky Lab’s Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014. ↩

  182. US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020. ↩

  183. FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024. ↩

  184. Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024. ↩

  185. Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021. ↩

  186. Khandelwal, S. (2018, June 14). Chinese Hackers Carried Out Country-Level Watering Hole Attack. Retrieved August 18, 2018. ↩

  187. Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018. ↩

  188. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Tools Report. Retrieved March 10, 2016. ↩

  189. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. ↩

  190. Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019. ↩

  191. Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018. ↩

  192. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020. ↩

  193. Alyac. (2019, April 3). Kimsuky Organization Steals Operation Stealth Power. Retrieved August 13, 2019. ↩

  194. ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019. ↩

  195. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. ↩

  196. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019. ↩

  197. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019. ↩

  198. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017. ↩

  199. Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024. ↩

  200. Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024. ↩

  201. Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017. ↩

  202. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  203. SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19  ↩

  204. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  205. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016. ↩

  206. Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023. ↩

  207. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. ↩

  208. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩

  209. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  210. Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024. ↩

  211. Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018. ↩

  212. Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024. ↩