H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[KEYPLUG](https://attack.mitre.org/software/S1051) is a modular backdoor written in C++, with Windows and Linux variants, that has been used by [APT41](https://attack.mitre.org/groups/G0096) since at least June 2021.(Citation: Mandiant APT41)

Labels

malware

10 recorded

Relationships

uses

from APT41

Group

uses

from C0017

Campaign

uses

to Asymmetric Cryptography

Technique

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Proxy

Technique

uses

to System Time Discovery

Technique

uses

to Web Protocols

Technique

3 external

References

mitre-attack

S1051

open

KEYPLUG.LINUX

—

Mandiant APT41

https://www.mandiant.com/resources/apt41-us-state-governments

open