value:  APT39 has used tools for capturing keystrokes. ;; APT41 used a keylogger called GEARSHIFT on a target system. ;; Astaroth logs keystrokes from the victim's machine. ;; One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process. ;; BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger. ;; When it first starts BADNEWS spawns a new thread to log keystrokes. ;; BadPatch has a keylogging capability. ;; Bandook contains keylogging capabilities ;; BISCUIT can capture keystrokes. ;; BlackEnergy has run a keylogger plug-in on a victim. ;; Cadelspy has the ability to log keystrokes on the compromised host. ;; Carbanak logs key strokes for configured processes and sends them back to the C2 server. ;; Cardinal RAT can log keystrokes. ;; Catchamas collects keystrokes from the victim’s machine. ;; CHOPSTICK is capable of performing keylogging. ;; Cobalt Strike can track key presses with a keylogger module. ;; Cobian RAT has a feature to perform keylogging on the victim’s machine. ;; CosmicDuke uses a keylogger. ;; DarkComet has a keylogging capability. ;; Darkhotel has used a keylogger. ;; Daserf can log keystrokes. ;; Derusbi is capable of logging keystrokes. ;; DOGCALL is capable of logging keystrokes. ;; Dtrack’s dropper contains a keylogging executable. ;; Duqu can track key presses with a keylogger module. ;; DustySky contains a keylogger. ;; ECCENTRICBANDWAGON can capture and store keystrokes. ;; Empire includes keylogging capabilities for Windows Linux and macOS systems. ;; EvilGrab has the capability to capture keystrokes. ;; Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers. ;; FakeM contains a keylogger module. ;; FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger. ;; Fysbis can perform keylogging. ;; gh0st RAT has a keylogger. ;; Grandoreiro can log keystrokes on the victim's machine. ;; GreyEnergy has a module to harvest pressed keystrokes. ;; Malware used by Group5 is capable of capturing keystrokes. ;; The executable version of Helminth has a module to log keystrokes. ;; HTTPBrowser is capable of capturing keystrokes on victims. ;; Imminent Monitor has a keylogging module. ;; InvisiMole can capture keystrokes on a compromised host. ;; JPIN contains a custom keylogger. ;; jRAT has the capability to log keystrokes from the victim’s machine both offline and online. ;; Kasidet has the ability to initiate keylogging. ;; Ke3chang has used keyloggers. ;; KeyBoy installs a keylogger for intercepting credentials and keystrokes. ;; KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function. ;; Kimsuky has used a PowerShell-based keylogger. ;; Kivars has the ability to initiate keylogging on the infected host. ;; KONNI has the capability to perform keylogging. ;; Lazarus Group malware KiloAlfa contains keylogging functionality. ;; Lokibot has the ability to capture input on the compromised host via keylogging. ;; Machete logs keystrokes from the victim’s machine. ;; MacSpy captures keystrokes. ;; Magic Hound malware is capable of keylogging. ;; Matryoshka is capable of keylogging. ;; menuPass has used key loggers to steal usernames and passwords. ;; Metamorfo has a command to launch a keylogger on the victim’s machine. ;; Micropsia has keylogging capabilities. ;; MoonWind has a keylogger. ;; NanoCore can perform keylogging on the victim’s machine. ;; NavRAT logs the keystrokes on the targeted system. ;; NetTraveler contains a keylogger. ;; NETWIRE can perform keylogging. ;; njRAT is capable of logging keystrokes. ;; OilRig has used keylogging tools called KEYPUNCH and LONGWATCH. ;; Okrum was seen using a keylogger tool to capture keystrokes. ;; Operation Wocao has obtained the password for the victim's password manager via a custom keylogger. ;; OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file C:\log.txt. ;; PLATINUM has used several different keyloggers. ;; PlugX has a module for capturing keystrokes per process including window titles. ;; PoetRAT has used a Python tool named klog.exe for keylogging. ;; PoisonIvy contains a keylogger. ;; PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages. ;; PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes. ;; Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows. ;; Proton uses a keylogger to capture keystrokes. ;; Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped. ;; QuasarRAT has a built-in keylogger. ;; Regin contains a keylogger. ;; Remcos has a command for keylogging. ;; Remexi gathers and exfiltrates keystrokes from the machine. ;; Remsec contains a keylogger component. ;; Revenge RAT has a plugin for keylogging. ;; ROKRAT uses a keylogger to capture keystrokes and location of where the user is typing. ;; Rover has keylogging functionality. ;; RTM can record keystrokes from both the keyboard and virtual keyboard. ;; RunningRAT captures keystrokes and sends them back to the C2 server. ;; Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function. ;; SLOTHFULMEDIA has a keylogging capability. ;; Sowbug has used keylogging tools. ;; SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators. ;; Stolen Pencil has a tool to log keystrokes to %userprofile%\appdata\roaming\apach.{txt log}. ;; Sykipot contains keylogging functionality to steal passwords. ;; TajMahal has the ability to capture keystrokes on an infected host. ;; ThiefQuest uses the CGEventTap functions to perform keylogging. ;; Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework ScanBox to capture keystrokes. ;; TinyZBot contains keylogger functionality. ;; Trojan.Karagany can capture keystrokes on a compromised host. ;; Unknown Logger is capable of recording keystrokes. ;; VERMIN collects keystrokes from the victim machine. ;; XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log it can handle special characters and it will buffer by default 50 characters before sending them out over the C2 infrastructure. ;; yty uses a keylogger plugin to gather keystrokes. ;; Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN. ;; ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.
name: Input Capture: Keylogging