{"id":7497,"date":"2025-05-08T12:05:00","date_gmt":"2025-05-08T11:05:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&p=7497"},"modified":"2026-05-22T11:44:42","modified_gmt":"2026-05-22T10:44:42","slug":"keepass-trojanised-in-advanced-malware-campaign","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/keepass-trojanised-in-advanced-malware-campaign\/","title":{"rendered":"KeePass trojanised in advanced malware campaign"},"content":{"rendered":"\n
\n
\n

\n KeePass trojanised in advanced malware campaign<\/span><\/h1>
\n
\n \n \n Software Protection <\/span>\n \n Threat intelligence <\/span>\n <\/span>\n \n 08 May, 2025 <\/span>\n <\/div>\n <\/div>\n <\/div>\n
\n
\n

\n Share this <\/p>\n

\n \n \n
\n
\n
\n \"\" <\/figure>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n
\n
\n
\n

\n Authors <\/p>\n \n

\n
\n
\n \n \n <\/path>\n <\/path>\n <\/svg>\n <\/span>\n <\/div>\n
\n

Tim West<\/h3>\n \n \n <\/div>\n\n<\/div>\n\n
\n
\n \"\" <\/div>\n
\n

Mohammad Kazem Hassan Nejad<\/h3>\n \n

\n Senior Threat Intelligence Researcher, WithSecure <\/p>\n \n <\/div>\n\n<\/div>\n\n <\/div>\n\n <\/div>\n

\n

\n Download report\/s <\/p>\n \n

\n
\n \n Download report
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n

In 2025, WithSecure discovered a trojanised, and signed version of the open-source password manager\u00a0KeePass<\/b>, used to deliver malware and exfiltrate credentials.<\/h2>\n

Named\u00a0KeeLoader<\/b>, this modified installer was signed with trusted certificates and distributed via\u00a0malvertising<\/b>\u00a0and\u00a0typo-squat domains t<\/b>o victims across Europe.<\/p>\n

In this campaign, KeePass\u2019s actual\u00a0source code was altered<\/b>, allowing attackers to steal user credentials and deploy\u00a0Cobalt Strike beacons<\/b>\u00a0for deeper network access. This marks growing sophistication in attacker tradecraft \u2014blending watering-hole style attacks with credential theft and post-exploitation tools.<\/p>\n

The operation is linked to a\u00a0prolific Initial Access Broker<\/b>, likely historically connected to (now seemingly defunct)\u00a0BlackBasta<\/b>\u00a0ransomware, and highlights the growing sophistication of \u201cas-a-service\u201d cybercrime models.<\/p>\n

This case underscores the risks of trusted software being hijacked and weaponised. It calls for stronger software integrity checks, better ad platform oversight, and enhanced detection of stealthy loaders.<\/p>\n

Download the full research paper here, which offers technical analysis, indicators of compromise, and actionable defense guidance.<\/p>\n<\/div>\n

\n

\n Download report\/s <\/p>\n \n

\n
\n \n Download report
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n
\n
\n

\n What next?<\/span><\/h2>
\n
\n

Discover WithSecure\u2122 Elements Exposure Management.
\n– No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n Contact us<\/a> <\/div>\n <\/div> <\/div>\n <\/div>\n<\/section>\n\n\n\n\n\n
\n
\n

\n Related Labs content<\/span><\/h2>
\n
\n
\n

Find related content relating to this topic.<\/span><\/p>\n<\/div>\n <\/div>\n <\/div>\n <\/div> \n

\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n AI security<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n

15<\/p>\n

\n Read more<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n

WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations<\/h3>\n
\n Read more<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Attack Detection<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

DarkGate Rises: New version of DarkGate malware hunts like a Duck but bites like a RAT<\/h3>\n

Source: https:\/\/labs.withsecure.com\/publications\/darkgate-rises<\/p>\n

\n Read more<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n <\/div>\n
\n
\n <\/div>\n
\n
\n

Named KeeLoader, this modified installer was signed with trusted certificates and distributed via malvertising and typo-squat domains to victims across Europe.<\/p>\n","protected":false},"author":3,"featured_media":0,"template":"","categories":[231,269],"labs_content_type":[225],"class_list":["post-7497","lab_item","type-lab_item","status-publish","hentry","category-software-protection","category-threat-intelligence"],"acf":[],"card":"

\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

KeePass trojanised in advanced malware campaign<\/h3>\n

Named KeeLoader, this modified installer was signed with trusted certificates and distributed via malvertising and typo-squat domains to victims across Europe.<\/p>\n

\n Read more<\/a> <\/div>\n <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/7497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=7497"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=7497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}