{
  "family": "keydoor",
  "sample_count": 1,
  "category": "backdoor",
  "description": "<h3>Executive Summary</h3>\nKeydoor is a highly specialized malware family that combines the stealth capabilities of a sophisticated backdoor with the data-harvesting functions of an advanced keylogger. Primarily utilized in targeted espionage campaigns, Keydoor is engineered to silently infiltrate a system, establish a covert communication channel, and continuously record user activity—specifically focusing on intercepting credentials and sensitive communications before they can be encrypted.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKeydoor is predominantly deployed via spear-phishing campaigns utilizing weaponized attachments (e.g., Office documents with malicious macros) or delivered as a secondary payload by initial access brokers who have already compromised the perimeter.\n\nOnce executed, Keydoor's operations are divided into access and espionage:\n<ul>\n<li><strong>Covert Backdoor Access:</strong> Keydoor establishes a persistent, encrypted connection to a remote command-and-control (C2) server. Unlike noisy botnets, it often \"beacons\" infrequently (e.g., once every 24 hours) to evade detection by edge firewalls and network anomaly monitoring. This backdoor allows the attacker to silently upload secondary modules, exfiltrate data, or open an interactive remote shell.</li>\n<li><strong>Deep Keylogging (API Hooking):</strong> The malware implements a sophisticated keylogger by hooking deep into the Windows API (e.g., using `SetWindowsHookEx` or even kernel-mode drivers). This allows it to intercept keystrokes across all applications, specifically targeting web browsers, password managers, and enterprise SSO portals.</li>\n<li><strong>Clipboard and Screen Capture:</strong> To supplement keylogging, Keydoor frequently monitors the system clipboard (stealing copied passwords or cryptocurrency addresses) and takes periodic screenshots of the active desktop.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Keydoor infection is a critical security incident indicating active, targeted espionage. The malware allows attackers to completely bypass Multi-Factor Authentication (MFA) by stealing the plaintext passwords as they are typed, leading to immediate account compromise and lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the infected endpoint from the LAN immediately to sever the backdoor connection and halt data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n<li><strong>Forensic Memory Analysis:</strong> Because Keydoor relies heavily on API hooking, perform memory forensics (using tools like Volatility) to identify the specific hooks and extract the C2 configuration from volatile memory before rebooting the system.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Keydoor",
    "Backdoor.Keydoor",
    "Keylogger.Win32.Keydoor"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1059",
    "T1113",
    "T1115"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:59:16Z",
  "type": "Keylogger / Backdoor",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}