Malware
KeyPlug
- First Reported
- Jan 23, 2025
- Latest Reported
- Apr 17, 2025
Reported Context (3)
- A briefly exposed directory on infrastructure tied to KeyPlug malware revealed tooling likely used in active operations. The server, live for less than a day, exposed Fortinet firewall and VPN-targeting exploit scripts, Exposed Server Reveals RedGolf-Linked Fortinet Exploits and Shiseido Reconnaissance
- Take, for example, Hunt.io's recent investigation into the KeyPlug malware. Our cyber threat hunting team uncovered an entire infrastructure of command-and-control (C2) servers by analyzing TLS certificates that were How SSL Certificate History Can Help Threat Hunters Map Malicious Infrastructure
- Since our initial analysis, the 'Support_1024' field, which previously stood out in KeyPlug-related activity, has now been incorporated into WolfSSL's standard server PEM file (server.pem) published on GitHub. As a TLS Certificate and JA4X Clues Link New Servers to Suspected GhostWolf Infrastructure
CVE (2)
Malware (2)
People (1)
Threat Actors (6)
MITRE ATT&CK (7)
Vendors (2)
Products (7)
Tools (12)
Industries (1)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.