{
  "family": "apost",
  "sample_count": 109,
  "category": "trojan",
  "description": "APost (consistently cataloged across security research as Trojan:Win32/Apost, Trojan.Win32.APost, and Backdoor:Win32/Apost by Kaspersky, Trend Micro, and Microsoft Defender) is a targeted Windows trojan and spyware family active since 2012. Engineered primarily for covert reconnaissance, keystroke monitoring, and credential exfiltration, APost infiltrates endpoints through weaponized spearphishing email attachments, cracked application downloads, and drive-by web redirect chains. Once established on a target system, APost installs low-level Windows keyboard and mouse hooks, capturing keystrokes and active application titles to harvest enterprise credentials, banking logins, and corporate correspondence. Furthermore, the trojan takes periodic desktop screenshots, collects local system environment metadata (including active process trees, network interfaces, and user privileges), and establishes registry run key persistence. Stolen telemetry and captured credentials are obfuscated and exfiltrated over HTTP or direct TCP sockets to attacker-controlled command-and-control servers, with operators capable of issuing secondary download directives.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Apost",
    "Trojan.Win32.APost",
    "Backdoor:Win32/Apost",
    "Spyware.Win32.Apost"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Trojan:Win32/Apost threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "APost is a Windows spyware trojan designed to log keystrokes, capture screen activity, and steal user credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does APost infect corporate workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is predominantly delivered via spearphishing emails with malicious attachments and trojanized utility downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does APost possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It logs user keystrokes, records active window titles, captures desktop screenshots, and harvests stored account credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does APost achieve persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run masquerading as system utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation actions are recommended for an APost compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the machine, perform memory analysis to extract C2 endpoints, execute full antimalware cleanup, and reset credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1082",
    "T1053.005",
    "T1547.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the endpoint from network and internet interfaces to halt active credential and screenshot exfiltration.",
    "Capture volatile RAM to preserve decrypted keystroke buffers, active socket connections, and C2 IP addresses.",
    "Enforce immediate password resets for all corporate accounts and email systems accessed from the infected workstation.",
    "Audit the Windows Registry Run keys and Task Scheduler to eliminate persistent autostart configurations."
  ],
  "what_to_avoid": [
    "Do not allow the machine to remain on the network while conducting triage, as operators can exfiltrate sensitive data in real time.",
    "Avoid relying solely on file deletion, as active in-memory keylogger hooks will continue intercepting sensitive inputs."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Enterprise and Corporate Networks",
    "Financial Services"
  ],
  "motivation": "Information Theft",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Targeted Espionage Actors"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "collection",
    "credential_access",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "lineage": {
    "derived_from": [
      "Classic Windows Spyware Trojans"
    ],
    "variants": [
      "APost.A",
      "APost.B",
      "Backdoor.Apost"
    ]
  },
  "iocs": {
    "file_hashes": [
      "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e",
      "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f"
    ],
    "delivery": [
      "Spearphishing emails with malicious attachments",
      "Trojanized utility downloads from third-party sites"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ApostAgent",
      "Windows Scheduled Task launching dropped binary from %AppData%\\Roaming"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.APost",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.apost"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.APost",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.APost/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}