Keyboy

Overview

Backdoor:Win32/Keyboy is a sophisticated Remote Access Trojan (RAT) and backdoor heavily utilized by Chinese-speaking Advanced Persistent Threat (APT) groups, most notably 'Tropic Trooper' (also known as KeyBoy or Pirate Panda). It is deployed primarily for long-term cyber espionage, focusing on exfiltrating intellectual property and sensitive documents from government, military, and healthcare targets in Taiwan and Southeast Asia.

Understanding Keyboy (APT Espionage)
To an end-user, Keyboy operates completely silently in the background. For a threat intelligence analyst, discovering Keyboy is a major incident. It is not mass-distributed malware; it is a highly targeted tool used by professional operators to establish a persistent, stealthy foothold (`T1098`) within a specific organization's network.

Execution and Espionage Mechanics
Keyboy is traditionally delivered via highly targeted spear-phishing campaigns (`T1566.001`) utilizing weaponized Microsoft Word documents exploiting known CVEs (like CVE-2012-0158). More recent variants have utilized DLL side-loading (`T1574.002`) to execute. Once active, the backdoor gathers extensive system profiling data and communicates with its C2 infrastructure using custom, often encrypted, protocols over HTTP/HTTPS. Keyboy provides operators with a reverse shell, file manipulation capabilities, and the ability to download and execute secondary reconnaissance tools, specifically targeting documents with `.doc`, `.xls`, `.pdf`, and `.ppt` extensions (`T1005`) for exfiltration (`T1041`).

Indicators of Compromise & Impact
The impact is the unauthorized disclosure of highly sensitive intellectual property and state secrets. Host-based IoCs include the presence of known Keyboy DLLs or disguised executables, and EDR alerts for DLL side-loading (e.g., a legitimate, signed executable loading a malicious DLL from an unexpected directory). Network IoCs include periodic beaconing traffic to known Tropic Trooper C2 infrastructure, often characterized by specific HTTP header anomalies.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_KEYBOY_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keyboy"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "keyboy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Keyboy (Trojan) Execution & Triage
id: c97b68b2-9f07-5763-ae76-d4c8e6eeecb0
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Keyboy malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/keyboy
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1005
- attack.t1574_002
- attack.t1566_001
- attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_KEYBOY_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keyboy tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "keyboy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the compromised endpoint. Do not simply wipe it; this is an APT attack requiring forensic analysis.
2. Analyze EDR telemetry to trace the initial infection vector (likely a specific spear-phishing email) to identify other potential targets in the organization.
3. Perform a massive enterprise-wide search for the specific C2 IPs/domains and any known Keyboy file hashes or DLL side-loading patterns.
4. Initiate an enterprise-wide credential reset, assuming the attackers have dumped credentials to facilitate lateral movement.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not treat this as a standard malware infection; standard reimaging will destroy critical forensic evidence of the APT's activities.
2. Avoid communicating about the incident on the compromised network; assume the attackers are monitoring internal communications.

References & External Analysis

• Search "keyboy" on VirusTotal (External Analysis)
• Search "keyboy" on Any.Run (Sandbox Sandbox)
• Search "keyboy" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Trash
• Wizrem
• Streespyer
• Spypro
• Sofacy
• Bzub
• Cridex
• Bozok

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/keyboy.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.