{
  "family": "keyboy",
  "sample_count": 2,
  "category": "trojan",
  "description": "Backdoor:Win32/Keyboy is a sophisticated Remote Access Trojan (RAT) and backdoor heavily utilized by Chinese-speaking Advanced Persistent Threat (APT) groups, most notably 'Tropic Trooper' (also known as KeyBoy or Pirate Panda). It is deployed primarily for long-term cyber espionage, focusing on exfiltrating intellectual property and sensitive documents from government, military, and healthcare targets in Taiwan and Southeast Asia.<br><br><b>Understanding Keyboy (APT Espionage)</b><br>To an end-user, Keyboy operates completely silently in the background. For a threat intelligence analyst, discovering Keyboy is a major incident. It is not mass-distributed malware; it is a highly targeted tool used by professional operators to establish a persistent, stealthy foothold (`T1098`) within a specific organization's network.<br><br><b>Execution and Espionage Mechanics</b><br>Keyboy is traditionally delivered via highly targeted spear-phishing campaigns (`T1566.001`) utilizing weaponized Microsoft Word documents exploiting known CVEs (like CVE-2012-0158). More recent variants have utilized DLL side-loading (`T1574.002`) to execute. Once active, the backdoor gathers extensive system profiling data and communicates with its C2 infrastructure using custom, often encrypted, protocols over HTTP/HTTPS. Keyboy provides operators with a reverse shell, file manipulation capabilities, and the ability to download and execute secondary reconnaissance tools, specifically targeting documents with `.doc`, `.xls`, `.pdf`, and `.ppt` extensions (`T1005`) for exfiltration (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the unauthorized disclosure of highly sensitive intellectual property and state secrets. Host-based IoCs include the presence of known Keyboy DLLs or disguised executables, and EDR alerts for DLL side-loading (e.g., a legitimate, signed executable loading a malicious DLL from an unexpected directory). Network IoCs include periodic beaconing traffic to known Tropic Trooper C2 infrastructure, often characterized by specific HTTP header anomalies.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1005",
    "T1574.002",
    "T1566.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1005",
      "name": "Data from Local System (Targeting specific document types)",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint. Do not simply wipe it; this is an APT attack requiring forensic analysis.",
    "Analyze EDR telemetry to trace the initial infection vector (likely a specific spear-phishing email) to identify other potential targets in the organization.",
    "Perform a massive enterprise-wide search for the specific C2 IPs/domains and any known Keyboy file hashes or DLL side-loading patterns.",
    "Initiate an enterprise-wide credential reset, assuming the attackers have dumped credentials to facilitate lateral movement."
  ],
  "what_to_avoid": [
    "Do not treat this as a standard malware infection; standard reimaging will destroy critical forensic evidence of the APT's activities.",
    "Avoid communicating about the incident on the compromised network; assume the attackers are monitoring internal communications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}