{
  "family": "keydoor",
  "sample_count": 1,
  "category": "backdoor",
  "description": "<h3>Executive Summary</h3>\nKeydoor is a highly specialized malware family that combines the stealth capabilities of a sophisticated backdoor with the data-harvesting functions of an advanced keylogger. Primarily utilized in targeted espionage campaigns, Keydoor is engineered to silently infiltrate a system, establish a covert communication channel, and continuously record user activity—specifically focusing on intercepting credentials and sensitive communications before they can be encrypted.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKeydoor is predominantly deployed via spear-phishing campaigns utilizing weaponized attachments (e.g., Office documents with malicious macros) or delivered as a secondary payload by initial access brokers who have already compromised the perimeter.\n\nOnce executed, Keydoor's operations are divided into access and espionage:\n<ul>\n<li><strong>Covert Backdoor Access:</strong> Keydoor establishes a persistent, encrypted connection to a remote command-and-control (C2) server. Unlike noisy botnets, it often \"beacons\" infrequently (e.g., once every 24 hours) to evade detection by edge firewalls and network anomaly monitoring. This backdoor allows the attacker to silently upload secondary modules, exfiltrate data, or open an interactive remote shell.</li>\n<li><strong>Deep Keylogging (API Hooking):</strong> The malware implements a sophisticated keylogger by hooking deep into the Windows API (e.g., using `SetWindowsHookEx` or even kernel-mode drivers). This allows it to intercept keystrokes across all applications, specifically targeting web browsers, password managers, and enterprise SSO portals.</li>\n<li><strong>Clipboard and Screen Capture:</strong> To supplement keylogging, Keydoor frequently monitors the system clipboard (stealing copied passwords or cryptocurrency addresses) and takes periodic screenshots of the active desktop.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Keydoor infection is a critical security incident indicating active, targeted espionage. The malware allows attackers to completely bypass Multi-Factor Authentication (MFA) by stealing the plaintext passwords as they are typed, leading to immediate account compromise and lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the infected endpoint from the LAN immediately to sever the backdoor connection and halt data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n<li><strong>Forensic Memory Analysis:</strong> Because Keydoor relies heavily on API hooking, perform memory forensics (using tools like Volatility) to identify the specific hooks and extract the C2 configuration from volatile memory before rebooting the system.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Keydoor",
    "Backdoor.Keydoor",
    "Keylogger.Win32.Keydoor"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Keydoor and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keydoor is classified as a Backdoor. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Keydoor establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keydoor typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Keydoor compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Keydoor should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What remote administrative and surveillance capabilities does Trojan.Keydoor provide to threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As an interactive backdoor and remote access tool, Trojan.Keydoor grants operators comprehensive control over the victim host. Common surveillance and management modules include real-time keystroke logging, desktop screen capture, remote VNC streaming, webcam and audio recording, arbitrary shell command execution, reverse proxy pivoting, and bidirectional file transfer capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Trojan.Keydoor traverse firewalls and sustain resilient command-and-control (C2) connections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Trojan.Keydoor establishes persistent outbound TCP or TLS connections back to threat actor infrastructure, effectively bypassing inbound firewall filtering. To maintain connection resilience against IP takedowns, variants frequently employ dynamic DNS services, fallback command servers, encrypted dead-drop resolvers on social platforms, or DNS over HTTPS (DoH) querying."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1059",
    "T1113",
    "T1115"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "type": "Keylogger / Backdoor",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised host from internal LAN and WAN environments to cut off interactive remote shell sessions established by Keydoor.",
    "Inspect active socket listeners and outbound established network connections ('netstat -ano') to identify and sever covert TCP/UDP channels used by Keydoor.",
    "Scan Windows Services, Scheduled Tasks, and Startup folders to locate and eliminate persistent backdoor listeners configured by Keydoor.",
    "Invalidate all active VPN profiles, local administrator credentials, and session tokens that may have been harvested by the Keydoor operator.",
    "Re-image the affected host using a validated golden image prior to reconnecting it to enterprise network segments."
  ],
  "what_to_avoid": [
    "Do not attempt to interact with or send messages through the Keydoor remote terminal, as this alerts the attacker and may cause them to execute destructive anti-forensic commands.",
    "Avoid relying solely on static file signatures, as Keydoor payloads frequently execute reflectively in memory without writing binaries to disk."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}