KEYPLUG

KeyPlug is a sophisticated malware developed by APT41, also known as the Chinese RedGolf Group. It's written in C++ and supports multiple network protocols for command and control (C2) traffic, including HTTP, TCP, KCP over UDP, and WSS. The malware was primarily used to target Windows systems, specifically state government entities between June 2021 and December 2021. However, its reach extended to Linux systems as well, with a new variant, KEYPLUG.LINUX, being deployed on Linux servers at various victims. The deployment of the Linux version of KeyPlug followed closely after the state government campaign, indicating a significant shift in targets. The malware has been associated with numerous attacks, including those against Italian industries. It is designed to exploit unpatched vulnerabilities in both Windows and Linux systems. Despite Linux's robust security, systems that have not been updated for an extended period are susceptible to this backdoor attack. Notably, KeyPlug uses a custom algorithm for hashing the names of the APIs to dynamically load in the first part of the shellcode. There have been hypotheses linking KeyPlug malware to the Hector leak, although these claims lack direct evidence and therefore remain speculative. Regardless, KeyPlug remains a substantial threat due to its modular design and ability to use various protocols like TCP, UDP, WSS, HTTP, QUIC, making it a versatile tool for cyber espionage and data theft.