Tag: keyplug

A server linked to KeyPlug malware briefly exposed tooling used in active operations. The infrastructure, live for less than a day, revealed Fortinet firewall and VPN exploit scripts, a PHP webshell, and network reconnaissance tools targeting authentication and internal portals of a major Japanese …

The article analyzes a cluster of network infrastructure associated with KEYPLUG, attributed to a suspected Chinese state-sponsored actor known as RedGolf or APT41. By examining historical TLS certificates and server configurations, researchers uncovered ongoing activity and links to recent operati…