{
  "family": "mokes",
  "sample_count": 35,
  "category": "trojan",
  "description": "Backdoor:Win32/Mokes (also known as Ekipa) is a rare, highly sophisticated Remote Access Trojan (RAT) notable for being a true cross-platform threat. It is engineered with distinct variants capable of natively infecting Windows, macOS (OSX/Mokes), and Linux environments, providing the threat actor with comprehensive surveillance capabilities across an entire heterogeneous enterprise network.<br><br><b>Understanding Mokes</b><br>To the end-user, Mokes operates completely invisibly. For threat intelligence analysts, Mokes represents a targeted espionage tool. While most malware is written specifically for Windows, Mokes is written in C++ (often utilizing Qt libraries statically linked to bypass dependency issues on Linux/macOS) to ensure seamless compilation across operating systems. This allows the threat actor to maintain a single C2 infrastructure to control a wildly diverse botnet.<br><br><b>Execution and Surveillance Strategies</b><br>Mokes is typically delivered via spearphishing or exploiting unpatched vulnerabilities on public-facing servers. Upon execution, it establishes persistence (e.g., via Registry Run keys on Windows, or `.plist` LaunchAgents on macOS) (`T1547.001`). Mokes possesses exhaustive surveillance capabilities. It can capture screenshots (`T1113`), record audio via the microphone (`T1120`), log keystrokes (`T1056.001`), and silently exfiltrate office documents (`T1005`). Notably, it encrypts all its exfiltrated data using AES-256 before transmitting it over HTTP/HTTPS to hardcoded C2 servers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality across the network, regardless of the operating system used by the victim. EDR platforms will flag anomalous child processes and unauthorized access to the microphone or screen capture APIs. Network logs will reveal encrypted, periodic beaconing to the C2 infrastructure. On Windows, the presence of anomalous executables in `%AppData%\\AppStore\\` or `%Temp%` is a common IoC. On macOS, look for unsigned binaries in `~/Library/AppStore/`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1120",
    "T1113",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1120",
      "name": "Video/Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session and halt data exfiltration.",
    "Capture a full forensic memory image of the machine to extract the decrypted Mokes payload, its C2 configuration, and any buffered keystrokes.",
    "Audit the persistence mechanisms appropriate for the OS (Windows Registry Run keys, macOS LaunchAgents, or Linux crontabs) to remove the backdoor.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid assuming that macOS or Linux endpoints are safe; Mokes is explicitly designed to compromise those systems."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}