{
  "family": "keyboy",
  "sample_count": 2,
  "category": "trojan",
  "description": "Backdoor:Win32/Keyboy is a sophisticated Remote Access Trojan (RAT) and backdoor heavily utilized by Chinese-speaking Advanced Persistent Threat (APT) groups, most notably 'Tropic Trooper' (also known as KeyBoy or Pirate Panda). It is deployed primarily for long-term cyber espionage, focusing on exfiltrating intellectual property and sensitive documents from government, military, and healthcare targets in Taiwan and Southeast Asia.<br><br><b>Understanding Keyboy (APT Espionage)</b><br>To an end-user, Keyboy operates completely silently in the background. For a threat intelligence analyst, discovering Keyboy is a major incident. It is not mass-distributed malware; it is a highly targeted tool used by professional operators to establish a persistent, stealthy foothold (`T1098`) within a specific organization's network.<br><br><b>Execution and Espionage Mechanics</b><br>Keyboy is traditionally delivered via highly targeted spear-phishing campaigns (`T1566.001`) utilizing weaponized Microsoft Word documents exploiting known CVEs (like CVE-2012-0158). More recent variants have utilized DLL side-loading (`T1574.002`) to execute. Once active, the backdoor gathers extensive system profiling data and communicates with its C2 infrastructure using custom, often encrypted, protocols over HTTP/HTTPS. Keyboy provides operators with a reverse shell, file manipulation capabilities, and the ability to download and execute secondary reconnaissance tools, specifically targeting documents with `.doc`, `.xls`, `.pdf`, and `.ppt` extensions (`T1005`) for exfiltration (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the unauthorized disclosure of highly sensitive intellectual property and state secrets. Host-based IoCs include the presence of known Keyboy DLLs or disguised executables, and EDR alerts for DLL side-loading (e.g., a legitimate, signed executable loading a malicious DLL from an unexpected directory). Network IoCs include periodic beaconing traffic to known Tropic Trooper C2 infrastructure, often characterized by specific HTTP header anomalies.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Keyboy and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keyboy is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Keyboy establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keyboy typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Keyboy compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Keyboy should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Keyboy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keyboy frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Keyboy across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Keyboy by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1005",
    "T1574.002",
    "T1566.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1005",
      "name": "Data from Local System (Targeting specific document types)",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint. Do not simply wipe it; this is an APT attack requiring forensic analysis.",
    "Analyze EDR telemetry to trace the initial infection vector (likely a specific spear-phishing email) to identify other potential targets in the organization.",
    "Perform a massive enterprise-wide search for the specific C2 IPs/domains and any known Keyboy file hashes or DLL side-loading patterns.",
    "Initiate an enterprise-wide credential reset, assuming the attackers have dumped credentials to facilitate lateral movement."
  ],
  "what_to_avoid": [
    "Do not treat this as a standard malware infection; standard reimaging will destroy critical forensic evidence of the APT's activities.",
    "Avoid communicating about the incident on the compromised network; assume the attackers are monitoring internal communications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}