Input Capture: Keylogging

ADVSTORESHELL can perform keylogging.^[13][14]

Agent Tesla can log keystrokes on the victim’s machine.^{[49][50][51][52]}

APT28 has used tools to perform keylogging.^[117][55]

APT3 has used a keylogging tool that records keystrokes in encrypted files.^[103]

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.^[125]

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.^[106]

APT39 has used tools for capturing keystrokes.^[123]

APT41 used a keylogger called GEARSHIFT on a target system.^[93]

Astaroth logs keystrokes from the victim's machine. ^[82]

One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.^[98]

BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.^[95]

When it first starts, BADNEWS spawns a new thread to log keystrokes.^[41][42][43]

BadPatch has a keylogging capability.^[22]

Bandook contains keylogging capabilities^[71]

BISCUIT can capture keystrokes.^[76]

BlackEnergy has run a keylogger plug-in on a victim.^[77]

Cadelspy has the ability to log keystrokes on the compromised host.^[101]

Carbanak logs key strokes for configured processes and sends them back to the C2 server.^[24][25]

Cardinal RAT can log keystrokes.^[73]

Catchamas collects keystrokes from the victim’s machine.^[62]

CHOPSTICK is capable of performing keylogging.^[54][13][55]

Cobalt Strike can track key presses with a keylogger module.^[9]

Cobian RAT has a feature to perform keylogging on the victim’s machine.^[60]

CosmicDuke uses a keylogger.^[66]

DarkComet has a keylogging capability.^[21]

Darkhotel has used a keylogger.^[110]

Daserf can log keystrokes.^[74][75]

Derusbi is capable of logging keystrokes.^[36]

DOGCALL is capable of logging keystrokes.^[63][64]

Duqu can track key presses with a keylogger module.^[33]

DustySky contains a keylogger.^[15]

Empire includes keylogging capabilities for Windows, Linux, and macOS systems.^[10]

EvilGrab has the capability to capture keystrokes.^[16]

FakeM contains a keylogger module.^[78]

FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.^[113][114]

Fysbis can perform keylogging.^[92]

gh0st RAT has a keylogger.^[37]

GreyEnergy has a module to harvest pressed keystrokes.^[56]

Malware used by Group5 is capable of capturing keystrokes.^[88]

The executable version of Helminth has a module to log keystrokes.^[69]

HTTPBrowser is capable of capturing keystrokes on victims.^[59]

Imminent Monitor has a keylogging module.^[12]

JPIN contains a custom keylogger.^[48]

jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.^[67][68]

Kasidet has the ability to initiate keylogging.^[79]

Ke3chang has used keyloggers.^[118]

KeyBoy installs a keylogger for intercepting credentials and keystrokes.^[89]

Kimsuky has used a PowerShell-based keylogger.^[121][122]

Kivars has the ability to initiate keylogging on the infected host.^[97]

KONNI has the capability to perform keylogging.^[46]

Lazarus Group malware KiloAlfa contains keylogging functionality.^[104][105]

Lokibot has the ability to capture input on the compromised host via keylogging.^[100]

Machete logs keystrokes from the victim’s machine.^[90][91]

MacSpy captures keystrokes.^[18]

Magic Hound malware is capable of keylogging.^[115] Magic Hound used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.^[116]

Matroyshka is capable of keylogging.^[29][30]

menuPass has used key loggers to steal usernames and passwords.^[120]

Micropsia has keylogging capabilities.^[72]

MoonWind has a keylogger.^[28]

NanoCore can perform keylogging on the victim’s machine.^[26]

NavRAT logs the keystrokes on the targeted system.^[61]

NetTraveler contains a keylogger.^[40]

NETWIRE can perform keylogging.^[34][35]

njRAT is capable of logging keystrokes.^[86][87][88]

OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.^[108][109]

Okrum was seen using a keylogger tool to capture keystrokes. ^[99]

OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.^[59]

PLATINUM has used several different keyloggers.^[48]

PlugX has a module for capturing keystrokes per process including window titles.^[20]

PoetRAT has used a Python tool named klog.exe for keylogging.^[96]

PoisonIvy contains a keylogger.^[57][58]

PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.^[11]

PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.^[7][8]

Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.^[17]

Proton uses a keylogger to capture keystrokes.^[18]

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.^[2]

QuasarRAT has a built-in keylogger.^[5][6]

Regin contains a keylogger.^[23]

Remcos has a command for keylogging.^[3][4]

Remexi gathers and exfiltrates keystrokes from the machine.^[83]

Remsec contains a keylogger component.^[31][32]

Revenge RAT has a plugin for keylogging.^[84][85]

ROKRAT uses a keylogger to capture keystrokes and location of where the user is typing.^[70]

Rover has keylogging functionality.^[27]

RTM can record keystrokes from both the keyboard and virtual keyboard.^[38][39]

RunningRAT captures keystrokes and sends them back to the C2 server.^[45]

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.^[124]

Sowbug has used keylogging tools.^[107]

SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.^[47]

Stolen Pencil has a tool to log keystrokes to %userprofile%\appdata\roaming\apach.{{txt,log}}. ^[119]

Sykipot contains keylogging functionality to steal passwords.^[19]

TajMahal has the ability to capture keystrokes on an infected host.^[102]

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.^{[59][111][112]}

TinyZBot contains keylogger functionality.^[80]

Unknown Logger is capable of recording keystrokes.^[41]

VERMIN collects keystrokes from the victim machine.^[81]

XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.^[53]

yty uses a keylogger plugin to gather keystrokes.^[44]

Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.^[65]

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.^[93][94]