KeyBoy
Software · ATTACK:enterprise:S0387
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0387",
"title": "KeyBoy",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0387",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5dd649c0-bca4-488b-bd85-b180474ec62e",
"external_id": "S0387",
"domain": "enterprise",
"created": "2019-06-14T16:45:33.729Z",
"modified": "2024-04-18T18:25:18.520Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "KeyBoy"
},
{
"source_name": "Rapid7 KeyBoy Jun 2013",
"url": "https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/"
},
{
"source_name": "CitizenLab KeyBoy Nov 2016",
"url": "https://citizenlab.ca/2016/11/parliament-keyboy/"
},
{
"source_name": "PWC KeyBoys Feb 2017",
"url": "https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0aafbc63-2021-4c99-b273-1241943fd959
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bc7c262-604c-42af-8829-ce9f579436d4
Rapid7 KeyBoy Jun 2013 · PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b26c652-7f0e-41f1-810a-7e6c24f2bfdb
Rapid7 KeyBoy Jun 2013ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49d115fb-7a5a-4a6a-959d-0d76ab8394fb
CitizenLab KeyBoy Nov 2016ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--527e03b3-5b14-4a6c-ab05-0e18bac0357d
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1001.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63920a70-160d-46b3-a55f-05e8d7d30ba1
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65f57f42-9784-4ca2-8192-bfa90ffc075f
Rapid7 KeyBoy Jun 2013ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a9deb99-21d7-45e3-bebc-fbab668690f1
CitizenLab KeyBoy Nov 2016ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8343b346-e529-4f28-a569-ae5f9a862ddf
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8833fac6-778f-4cf8-8b2a-6dee29164ffa
Rapid7 KeyBoy Jun 2013 · PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96ea567d-7113-4c2e-82c4-2ae6c6916ae9
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b5e2072-35e7-4c62-baea-0e9d31df91f2
CitizenLab KeyBoy Nov 2016ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b71738d0-d96e-4508-9820-ece76386903c
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8f7512e-b0fe-4d27-ba63-bb99443d1b8c
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd2f299e-e471-4f32-96b6-8dc32e872c74
PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4768282-a422-45b3-9e60-43394063a468
Rapid7 KeyBoy Jun 2013 · PWC KeyBoys Feb 2017ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e49cb6bd-78c8-4826-a292-a7c5d3096d2b
Rapid7 KeyBoy Jun 2013ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1547.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7cf6c6b-d777-4c61-b760-e8c6a5c48488
CitizenLab KeyBoy Nov 2016 · PWC KeyBoys Feb 2017ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0387
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef2cc3f0-b44f-4f56-ba46-45e736ce0e90
Unit 42 Tropic Trooper Nov 2016 · CitizenLab Tropic Trooper Aug 2018