{"id":10375,"date":"2025-05-08T12:05:00","date_gmt":"2025-05-08T11:05:00","guid":{"rendered":"https:\/\/www.withsecure.com\/resources-hub\/w-labs\/keepass-trojanised-in-advanced-malware-campaign\/"},"modified":"2025-05-08T12:05:00","modified_gmt":"2025-05-08T11:05:00","slug":"keepass-trojanised-in-advanced-malware-campaign","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/de\/ressourcen\/w-labs\/keepass-trojanised-in-advanced-malware-campaign\/","title":{"rendered":"KeePass trojanised in advanced malware campaign"},"content":{"rendered":"\n
\n
\n

\n KeePass trojanised in advanced malware campaign<\/span><\/h1>
\n
\n \n \n Software Protection <\/span>\n \n Threat intelligence <\/span>\n <\/span>\n \n 08 Mai, 2025 <\/span>\n <\/div>\n <\/div>\n <\/div>\n
\n
\n

\n Teilen Sie dies <\/p>\n

\n \n \n
\n
\n
\n \"\" <\/figure>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n
\n
\n
\n

\n Authors <\/p>\n \n

\n
\n
\n \n \n <\/path>\n <\/path>\n <\/svg>\n <\/span>\n <\/div>\n
\n

Tim West<\/h3>\n \n \n <\/div>\n\n<\/div>\n\n
\n
\n \"\" <\/div>\n
\n

Mohammad Kazem Hassan Nejad<\/h3>\n \n

\n Senior Threat Intelligence Researcher, WithSecure <\/p>\n \n <\/div>\n\n<\/div>\n\n <\/div>\n\n <\/div>\n

\n

\n Download report\/s <\/p>\n \n

\n
\n \n Download report
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n

In 2025, WithSecure discovered a trojanised, and signed version of the open-source password manager\u00a0KeePass<\/b>, used to deliver malware and exfiltrate credentials.<\/h2>\n

Named\u00a0KeeLoader<\/b>, this modified installer was signed with trusted certificates and distributed via\u00a0malvertising<\/b>\u00a0and\u00a0typo-squat domains t<\/b>o victims across Europe.<\/p>\n

In this campaign, KeePass\u2019s actual\u00a0source code was altered<\/b>, allowing attackers to steal user credentials and deploy\u00a0Cobalt Strike beacons<\/b>\u00a0for deeper network access. This marks growing sophistication in attacker tradecraft \u2014blending watering-hole style attacks with credential theft and post-exploitation tools.<\/p>\n

The operation is linked to a\u00a0prolific Initial Access Broker<\/b>, likely historically connected to (now seemingly defunct)\u00a0BlackBasta<\/b>\u00a0ransomware, and highlights the growing sophistication of \u201cas-a-service\u201d cybercrime models.<\/p>\n

This case underscores the risks of trusted software being hijacked and weaponised. It calls for stronger software integrity checks, better ad platform oversight, and enhanced detection of stealthy loaders.<\/p>\n

Download the full research paper here, which offers technical analysis, indicators of compromise, and actionable defense guidance.<\/p>\n<\/div>\n

\n

\n Download report\/s <\/p>\n \n

\n
\n \n Download report
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n
\n
\n

\n What next?<\/span><\/h2>
\n
\n

Discover WithSecure\u2122 Elements Exposure Management.
\n– No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n Contact us<\/a> <\/div>\n <\/div> <\/div>\n <\/div>\n<\/section>\n\n\n\n\n\n
\n
\n

\n Related Labs content<\/span><\/h2>
\n
\n
\n

Find related content relating to this topic.<\/span><\/p>\n<\/div>\n <\/div>\n <\/div>\n <\/div> \n

\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Attack Detection<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

DarkGate Rises: New version of DarkGate malware hunts like a Duck but bites like a RAT<\/h3>\n

Source: https:\/\/labs.withsecure.com\/publications\/darkgate-rises<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Attack Detection<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

Reverse engineering a Lumma infection<\/h3>\n

Lumma is an information stealer that the WithSecure Detection and Response Team (DRT) have encountered several times. It has seen wider use over the past couple of years, and makes for an interesting threat to monitor.<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n AI security<\/span>\n Attack Detection<\/span>\n Software Protection<\/span>\n <\/div>\n <\/div>\n

Machine learning-driven malware analysis<\/h3>\n

With the rapid emergence of new malware variants, accurately classifying and attributing malware samples has become more challenging than ever<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n <\/div>\n
\n
\n <\/div>\n
\n
\n

Named KeeLoader, this modified installer was signed with trusted certificates and distributed via malvertising and typo-squat domains to victims across Europe.<\/p>\n","protected":false},"author":3,"featured_media":0,"template":"","categories":[311,312],"labs_content_type":[348],"class_list":["post-10375","lab_item","type-lab_item","status-publish","hentry","category-software-protection","category-threat-intelligence"],"acf":[],"card":"

\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

KeePass trojanised in advanced malware campaign<\/h3>\n

Named KeeLoader, this modified installer was signed with trusted certificates and distributed via malvertising and typo-squat domains to victims across Europe.<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/lab_item\/10375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/users\/3"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/media?parent=10375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/categories?post=10375"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/labs_content_type?post=10375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}