{
  "family": "refog",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "Spyware:Win32/Refog (also detected as Monitor:Win32/Refog or Riskware/Refog) is a commercially available 'employee monitoring' and 'parental control' software application. However, from a technical perspective, it possesses all the capabilities of a highly sophisticated, malicious keylogger and infostealer. Because it is frequently installed secretly by insiders, domestic abusers, or unauthorized individuals to covertly monitor a victim's activities, security vendors universally classify it as Spyware or Riskware.<br><br><b>Understanding the Refog Threat</b><br>To the person being monitored, Refog operates entirely invisibly. There are no tray icons or taskbar entries. For an enterprise security team, the presence of Refog is a critical incident, usually indicating a severe Insider Threat (`T1078`) or a profound violation of corporate privacy policies. It means every password typed, every email sent, and every application opened on that machine is being recorded and exfiltrated.<br><br><b>Execution and Surveillance Mechanics</b><br>Refog is typically installed locally by an individual with physical access or administrative credentials to the target machine (`T1199`). Once installed, it hooks deeply into the Windows operating system (`T1056.001`), often utilizing specialized kernel-mode drivers to intercept all keystrokes globally. It takes periodic screenshots (`T1113`), logs clipboard contents (`T1115`), tracks all visited URLs, and records chat application transcripts (`T1114`). The software then compiles this massive surveillance cache and stealthily exfiltrates it to the installer, either via scheduled emails, hidden FTP uploads, or by syncing to a cloud portal provided by the Refog vendor (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of endpoint privacy and the theft of all entered credentials and sensitive data. Host-based IoCs include the presence of known Refog installation directories (often obfuscated or hidden in `ProgramData` or `System32`), the loading of specific surveillance DLLs (`mpk.dll` is historically associated with Refog/MPK), and hidden scheduled tasks. Network IoCs include periodic, automated SMTP or HTTPS traffic sending large data blobs to external, non-corporate addresses or known Refog cloud portals.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1041",
    "T1199",
    "T1113"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Cloud sync or Email)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1199",
      "name": "Trusted Relationship (Insider installation)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Treat this as a high-severity Insider Threat incident. Do not immediately alert the user, as the installer may be their manager or a hostile insider.",
    "Isolate the endpoint to halt the active exfiltration of surveillance data.",
    "Coordinate closely with HR and Legal departments to determine if the installation was a sanctioned (but poorly communicated) corporate monitoring initiative or an unauthorized abuse.",
    "If unauthorized, reimage the machine and force a reset of all passwords typed on that endpoint, as they are completely compromised."
  ],
  "what_to_avoid": [
    "Do not ignore the detection because it is a 'commercial' tool; commercial keyloggers are identical in function to malware and represent a massive liability.",
    "Avoid assuming an external threat actor installed it; commercial spyware is almost always installed by someone with pre-existing physical or logical access."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}