{
  "family": "wpakill",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Wpakill is a classification for a suite of specialized utilities designed to audit, brute-force, or crack Wi-Fi network security, specifically targeting WPA and WPA2 encryption (`T1110.001`). While sometimes used legitimately by penetration testers, tools flagged as Wpakill are frequently weaponized by attackers to gain unauthorized initial access to corporate or private wireless networks during the reconnaissance phase of an attack.<br><br><b>Understanding Wpakill (Network Cracking)</b><br>To an end-user, Wpakill is not a standard virus; they will likely never see it unless they are the ones trying to steal their neighbor's Wi-Fi. For a security team, detecting Wpakill on a corporate asset indicates either an insider threat, a rogue device on the network, or an attacker actively attempting to breach the physical perimeter via wireless vulnerabilities.<br><br><b>Execution and Cracking Mechanics</b><br>Wpakill tools generally operate by sniffing wireless traffic to capture the 4-way handshake (`T1040`) that occurs when a legitimate client authenticates to the Access Point (AP). Some tools may actively deauthenticate a client (`T1498.002`) to force this handshake to occur. Once the handshake is captured, Wpakill uses dictionary attacks or brute-force methods (often leveraging GPU acceleration) to guess the Pre-Shared Key (PSK).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of the wireless network perimeter, granting the attacker internal network access. Host-based IoCs include the presence of Wpakill executables, alongside massive dictionary text files (e.g., `rockyou.txt`) and `.cap` or `.pcap` files containing captured network traffic. Network IoCs are generally restricted to the wireless spectrum itself: wireless intrusion detection systems (WIDS) may flag a high volume of deauthentication frames or repeated, rapid failed authentication attempts against an Access Point.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1498.002",
    "T1040",
    "T1110.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing (Cracking the WPA/WPA2 Pre-Shared Key)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1040",
      "name": "Network Sniffing (Capturing the 4-way handshake)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498.002",
      "name": "Network Denial of Service: Endpoint Denial of Service (Deauthenticating clients to force a handshake)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "If the tool is found on a corporate asset, isolate the machine and investigate the user (insider threat protocol).",
    "Review wireless controller logs for anomalies (e.g., mass deauthentications, repeated failed logins).",
    "Transition the corporate wireless network from WPA2-PSK (Pre-Shared Key) to WPA2/3-Enterprise (802.1X using certificates), which neutralizes dictionary attacks against a single shared password.",
    "Implement a Wireless Intrusion Detection System (WIDS) to detect active rogue APs or deauthentication attacks."
  ],
  "what_to_avoid": [
    "Avoid relying on WEP or standard WPA2-PSK for critical corporate wireless networks.",
    "Do not ignore physical security; attackers using Wpakill must be physically near the Access Point to capture the handshake."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}