KEYPLUG

MITRE

Malware Type:
Other

First seen:
Unknown

Last seen:
Unknown

Details:

[KEYPLUG](https://attack.mitre.org/software/S1051) is a modular backdoor written in C++, with Windows and Linux variants, that has been used by [APT41](https://attack.mitre.org/groups/G0096) since at least June 2021.(Citation: Mandiant APT41)

Associated Techniques (8)

ID	ATT&CK	Tactics
T1027.013	Encrypted/Encoded File	-
T1071.001	Web Protocols	-
T1090	Proxy	-
T1095	Non-Application Layer Protocol	-
T1102.001	Dead Drop Resolver	-
T1124	System Time Discovery	-
T1140	Deobfuscate/Decode Files or Information	-
T1573.002	Asymmetric Cryptography	-

Aliases (105)

KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX KEYPLUG.LINUX

Used by Actors (1)

APT41
Nation-state

Metadata

ID:	317
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00