KEYPLUG
Description
(Mandiant) KEYPLUG is a modular backdoor written in C++ that supports multiple network protocols for command and control (C2) traffic including HTTP, TCP, KCP over UDP, and WSS.
Names
| Name |
|---|
| KEYPLUG |
| ELFSHELF |
Category
Malware
Type
- Backdoor
Information
- https://www.mandiant.com/resources/blog/apt41-us-state-governments
- https://yoroi.company/en/research/uncovering-an-undetected-keyplug-implant-attacking-industries-in-italy/
- https://hunt.io/blog/keyplug-server-exposes-fortinet-exploits-webshells
Mitre Attack
Malpedia
Other Information
Uuid
c549363e-03d1-4696-9d7e-5118831adf40
Last Card Change
2025-06-27