Skip to content

KEYPLUG

Software · ATTACK:enterprise:S1051

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1051",
  "title": "KEYPLUG",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1051",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--6c575670-d14c-4c7f-9b9d-fd1b363e255d",
  "external_id": "S1051",
  "domain": "enterprise",
  "created": "2022-12-12T15:47:08.197Z",
  "modified": "2024-04-11T01:46:20.169Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "KEYPLUG.LINUX"
    },
    {
      "source_name": "Mandiant APT41",
      "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
    }
  ]
}

Explicit source assertions (10)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b7f61c3-8600-4da7-bd6e-b304dd338d37

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f38f2dd-e2cf-4571-bb6c-065e50412bac

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13111e18-5f34-4925-ba0d-655a1fedeb52

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--249e7812-394b-44b0-adb7-d922139f7c38

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43c68bb8-28e2-4ee0-91aa-ffc16dcc45bc

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S1051

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--555b9de4-84c6-44f1-a6e6-b04a7e4ed374

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S1051

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6499cbec-f304-4170-9e6d-d6f89f841219

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba9380c1-1d2e-4161-8c46-9fc9f793cbd3

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e55f295e-3531-4f53-bd0e-2c51994d8b44

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9500f3a-11d5-46f5-96d8-14313b95142e

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.