{
  "family": "refog",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "Spyware:Win32/Refog (also detected as Monitor:Win32/Refog or Riskware/Refog) is a commercially available 'employee monitoring' and 'parental control' software application. However, from a technical perspective, it possesses all the capabilities of a highly sophisticated, malicious keylogger and infostealer. Because it is frequently installed secretly by insiders, domestic abusers, or unauthorized individuals to covertly monitor a victim's activities, security vendors universally classify it as Spyware or Riskware.<br><br><b>Understanding the Refog Threat</b><br>To the person being monitored, Refog operates entirely invisibly. There are no tray icons or taskbar entries. For an enterprise security team, the presence of Refog is a critical incident, usually indicating a severe Insider Threat (`T1078`) or a profound violation of corporate privacy policies. It means every password typed, every email sent, and every application opened on that machine is being recorded and exfiltrated.<br><br><b>Execution and Surveillance Mechanics</b><br>Refog is typically installed locally by an individual with physical access or administrative credentials to the target machine (`T1199`). Once installed, it hooks deeply into the Windows operating system (`T1056.001`), often utilizing specialized kernel-mode drivers to intercept all keystrokes globally. It takes periodic screenshots (`T1113`), logs clipboard contents (`T1115`), tracks all visited URLs, and records chat application transcripts (`T1114`). The software then compiles this massive surveillance cache and stealthily exfiltrates it to the installer, either via scheduled emails, hidden FTP uploads, or by syncing to a cloud portal provided by the Refog vendor (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of endpoint privacy and the theft of all entered credentials and sensitive data. Host-based IoCs include the presence of known Refog installation directories (often obfuscated or hidden in `ProgramData` or `System32`), the loading of specific surveillance DLLs (`mpk.dll` is historically associated with Refog/MPK), and hidden scheduled tasks. Network IoCs include periodic, automated SMTP or HTTPS traffic sending large data blobs to external, non-corporate addresses or known Refog cloud portals.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Refog and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Refog is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Refog establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Refog typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Refog compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Refog should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Refog leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Refog frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Refog maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Refog often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1041",
    "T1199",
    "T1113"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Cloud sync or Email)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1199",
      "name": "Trusted Relationship (Insider installation)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Treat this as a high-severity Insider Threat incident. Do not immediately alert the user, as the installer may be their manager or a hostile insider.",
    "Isolate the endpoint to halt the active exfiltration of surveillance data.",
    "Coordinate closely with HR and Legal departments to determine if the installation was a sanctioned (but poorly communicated) corporate monitoring initiative or an unauthorized abuse.",
    "If unauthorized, reimage the machine and force a reset of all passwords typed on that endpoint, as they are completely compromised."
  ],
  "what_to_avoid": [
    "Do not ignore the detection because it is a 'commercial' tool; commercial keyloggers are identical in function to malware and represent a massive liability.",
    "Avoid assuming an external threat actor installed it; commercial spyware is almost always installed by someone with pre-existing physical or logical access."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}