{
  "family": "keybase",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Spyware:Win32/Keybase is a prolific, commercially available software tool weaponized as a keylogger and spyware agent. Originally sold legally as an 'employee monitoring' tool, its builder software was cracked and leaked onto underground hacker forums. Consequently, Keybase became heavily utilized by low-skill cybercriminals ('script kiddies') to mount widespread, untargeted credential theft campaigns via phishing, completely eliminating privacy on infected machines.<br><br><b>Understanding Keybase (Commercial Keyloggers)</b><br>To an end-user, Keybase operates invisibly in the background. For a SOC analyst, detecting Keybase indicates an immediate breach of confidentiality; the attacker has successfully installed software that records every keystroke, clipboard copy, and website visited (`T1056.001`). Unlike advanced APT malware, Keybase is 'noisy' and easier to detect, but highly destructive if left unchecked.<br><br><b>Execution and Espionage Mechanics</b><br>Keybase is typically distributed via spam emails containing weaponized attachments (e.g., fake invoices or tracking receipts) (`T1566.001`). Upon execution (`T1204.002`), the compiled stub drops the main keylogger executable into the `%AppData%` directory and establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. It hooks into the Windows API (like `SetWindowsHookEx`) to intercept all keyboard input. It captures clipboard contents (`T1115`) and periodically takes screenshots of the active window (`T1113`). The harvested data is compiled into HTML or text files and exfiltrated to the attacker via SMTP (emailing the logs), FTP, or a web panel (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total theft of all passwords, personal communications, and financial data entered on the machine. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' (specifically keyboard hooks). A strong indicator is the creation of hidden directories in `%AppData%` containing massive text files (the key logs) and hundreds of screenshots. Network IoCs include the malware attempting to establish outbound SMTP (Port 25/587) or FTP (Port 21) connections to upload the stolen logs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Keybase and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keybase is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Keybase establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keybase typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Keybase compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Keybase should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Keybase leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keybase frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Keybase maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keybase often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1113",
    "T1041",
    "T1056.001",
    "T1115"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Primary data theft mechanism)",
      "tactic": "Collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data (Stealing copied passwords and crypto addresses)",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture (Visual confirmation of activity)",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Uploading logs via SMTP/FTP)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint; all typed passwords and viewed documents are actively being exfiltrated.",
    "Mandate an immediate password reset for the affected user, covering ALL corporate and personal accounts accessed on that machine.",
    "Uninstall the software and run a full AV scan to remove the executable and its autostart registry keys.",
    "Analyze firewall logs to determine the exfiltration destination (e.g., the attacker's email server or FTP site) and block it."
  ],
  "what_to_avoid": [
    "Do not allow the user to type new passwords on the machine until Keybase is fully removed, as the new passwords will simply be logged.",
    "Avoid treating this solely as a corporate issue; advise the user to monitor personal bank accounts, as the attacker likely stole those credentials as well."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}