In early 2025, threat actors deployed a trojanised KeePass installer to distribute Cobalt Strike and steal credentials. Named KeeLoader, the modified binary was signed with valid certificates and spread via malvertising and typo-squatted domains. This marks the first known case of KeePass source code being weaponised, combining infostealing and post-exploitation capabilities in a trusted package. The campaign remained undetected for months, leveraging stealthy execution and encrypted payloads. WithSecure links the infrastructure to a prolific Initial Access Broker, possibly affiliated with Black Basta ransomware operations.
Severity Level: High
THREAT OVERVIEW:
- Unattributed Actor: Likely a prolific Initial Access Broker (IAB).
- Affiliations: Overlaps with TTPs of Black Basta and BlackCat ransomware.
- Possible Links: Traces point to UNC4696 and infrastructure consistent with Ransomware-as-a-Service (RaaS).
- Capabilities: Advanced usage of signed binaries, Cobalt Strike beacons, malvertising infrastructure.
- Target regions: Global.
- Affected Sectors: IT Service Providers, Mid-market enterprises, financial institutions, Cryptocurrency platforms.
ATTACK FLOW:
- Initial Access Vector:
- Malvertising on platforms like Bing and DuckDuckGo directed users to lookalike KeePass domains (e.g., keeppaswrd[.]com).
- Users downloaded a trojanised KeePass installer: KeePass-2.56-Setup.exe, which appeared legitimate.
- Malware Functionality (KeeLoader):
- Modified KeePass binary acts as both password manager and infostealer.
- Drops a file (db.idx) disguised as a .JPG image, containing RC4-encrypted Cobalt Strike shellcode.
- Executes ShInstUtil.exe with the –update parameter to decrypt and load the shellcode in memory.
- Credential Theft:
- When users open KeePass and load a database, the malware dumps credentials (account, username, password, comments) into .kp files stored in %localappdata%.
- These files can then be accessed and exfiltrated via the established Cobalt Strike beacon.
- Infrastructure & Distribution:
- Domains like KeePass-info[.]aenys[.]com, lvshilc[.]com, and arch-online[.]com were used.
- Multiple certificate issuers were abused (e.g., S.R.L. INT-MCOM, Shenzhen Kantianxia Network Technology Co., Ltd.) to sign binaries and increase legitimacy.
- Typosquatting was employed to confuse users into downloading malware.
- Evasion Techniques:
- Use of valid code signing certificates.
- Encrypted shellcode in non-suspicious formats.
- Malicious functionality only activates after database access, bypassing sandbox detection.
- Payload & Post-Exploitation:
- Once active, the malware establishes C2 connections over HTTPS to arch-online[.]com and aicmas[.]com.
- Cobalt Strike is used for lateral movement (via RDP, SMB, SSH).
- In later stages, ransomware is deployed—although the binary was not recovered, the ransom note matched Akira templates with slight differences.
Recommendations:
- Block installation of software not sourced from authorized repositories. Prevent users from downloading installers via search engines.
- Use tools like Microsoft AppLocker or macOS Gatekeeper to allow only trusted, signed software.
- Validate KeePass binaries against known-good SHA256 hashes and digital certificate thumbprints.
- Alert on unusual .kp files in %localappdata%, e.g., ###.kp or ###.keps, especially if KeePass is not sanctioned.
- Monitor Run keys that auto-launch ShInstUtil.exe with suspicious parameters like –update.
- Ensure password managers and associated software are patched from official sources only.
- Enforce policies that prevent execution of binaries signed by untrusted or revoked certificates.
- Educate users on the dangers of malvertising and how to avoid downloading software from search engine ads.
- Block the IOCs at their respective controls.
https://www.virustotal.com/gui/collection/07b05618ce206ea8579e1ec0524649fde8710f462fb3982c458864e01d393e64/iocs
Source:
- https://labs.withsecure.com/publications/keepass-trojanised-in-advanced-malware-campaign
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.