KEYPLUG

KeyPlug is a malicious software (malware) primarily targeting Windows and Linux systems. The malware, written in C++, is a modular backdoor that supports multiple network protocols for command and control traffic, including HTTP, TCP, KCP over UDP, and WSS. It was first reported in March 2023 when the Chinese RedGolf Group started using it to exploit long-unpatched systems, particularly those running on Windows. Despite its association with the Windows operating system, the issue lies not with Linux itself but with these outdated, unsecured systems. The Advanced Persistent Threat group APT41 heavily utilized KeyPlug against state government victims from June to December 2021. Notably, following this campaign, they deployed a ported version of the backdoor, marking a significant development in their operations. Furthermore, a new variant of KeyPlug, known as KEYPLUG.LINUX, was introduced by APT41 on Linux servers across multiple victims. This malware sub-family has now been identified and is being tracked due to its potential threat. Italian industries have also been targeted by KeyPlug, with APT41 posing a significant threat. While Sandman, another suspected China-based adversary, has been associated with the use of KeyPlug, SentinelLabs continues to track Sandman as a distinct cluster until further conclusive information suggests otherwise. As such, the situation remains dynamic and requires ongoing monitoring to prevent further exploitation and damage.