Friday, June 14, 2024

Chinese Hackers Using KEYPLUG Backdoor to Attack Windows & Linux Systems

It has been reported by the Recorded Future’s Insikt Group that RedGolf, a Chinese state-sponsored threat actor group, was using a backdoor designed especially for Windows and Linux systems called KEYPLUG to infiltrate networks.

As one of the world’s most prolific threat groups, RedGolf has been active against a variety of industries around the world for many years.

RedGolf Infrastructure & TTPs

There is a history of this group developing and using a variety of custom malware families over the years. It has demonstrated an ability to weaponize newly reported vulnerabilities quickly.

Here below, we have mentioned the recently reported malware families used by this group:-

  • Log4Shell
  • ProxyLogon

The industries and organizations primarily targeted by RedGolf are:-

  • Aviation
  • Automotive
  • Education
  • Government
  • Media
  • Information technology
  • Religious organizations

Apart from this, there are a number of public and zero-day flaws that the RedGolf threat group has historically exploited for the purpose of gaining initial access to internet-facing devices, including:-


During 2021 and 2022, RedGolf targeted US state government entities using KEYPLUG, a custom and modular Linux backdoor.

Several KEYPLUG samples and infrastructures that RedGolf used from at least 2021 until 2023 have been identified by Insikt Group.

In a campaign that compromised the security of at least six state governments in the USA, RedGolf heavily used the KEYPLUG platform between May 2021 and February 2022, as first exposed by Google-owned Manidant in March 2022.

KEYPLUG C2, including the following, supports a total of 5 network protocols:-

  • HTTP
  • TCP
  • KCP
  • UDP
  • WSS

Technical Analysis

In October 2022, Malwarebytes published information on a separate set of attacks exploiting an unexplored implant dubbed DBoxAgent to use KEYPLUG on government entities in Sri Lanka early in August of that year.

As Recorded Future puts it, these campaigns appear to share a very close connection with RedGolf’s campaign, which was also attributed to Winnti  (aka APT41, Barium, Bronze Atlas, or Wicked Panda).

According to security analysts, the latest RedGolf activity has not yet been associated with any specific victimology.

Due to the overlaps between this action and previously reported cyber espionage campaigns, they believe these activities may be conducted for intelligence purposes instead of financial gain or profit.

Furthermore, it was noted that the hacking group used other tools such as Cobalt Strike and PlugX in addition to the KEYPLUG samples and its operational infrastructure, which is codenamed GhostWolf.

42 IP addresses comprise the GhostWolf infrastructure and are used as commands and controls for the KEYPLUG system.

To gain initial access to targets’ networks, RedGolf will keep demonstrating the operational tempo that will allow it to rapidly exploit vulnerabilities in externally facing enterprise appliances and quickly weaponize those vulnerabilities.


To defend against RedGolf attacks, organizations are required to follow the mitigations recommended by the experts that we have mentioned below:-

  • Ensure that patches are applied regularly.
  • Check access to the devices connected to the networks external to the organization.
  • Identify the command and control infrastructure used by threat actors and block it.
  • To monitor for malware, intrusion detection, and prevention systems need to be configured in a way that they detect malware.

Searching to secure your APIs? – Try Free API Penetration Testing

Related Read:


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles