LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0387: KeyBoy

KeyBoy is malware that has been used in targeted campaigns against members of the Tibetan Parliament in 2016.[1][2]

EnterpriseS0387MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

KeyBoy matters because ATT&CK records it as Windows malware used in targeted campaigns, with relationships showing a broad post-compromise pattern: execution through scripting and command shells, discovery of system/network/file information, credential collection through keylogging and browser credentials, screen capture, persistence through Windows services and Winlogon helper DLLs, stealth through encoded files, timestomping, and hidden windows, plus command-and-control activity that may impersonate legitimate protocols. For leaders, the decision value is not only “do we know this malware name,” but whether Windows endpoint, identity, and network monitoring can reconstruct these behaviors if a targeted intrusion occurs.

Executive priority

Prioritize KeyBoy as a coverage-validation case for targeted Windows intrusions rather than as a standalone malware alert. The ATT&CK relationships connect it to credential access, collection, persistence, discovery, execution, stealth, and command-and-control behaviors that can affect incident scope, identity risk, and business continuity. Executives should ask whether SOC and IR teams can prove they collect the evidence needed to detect suspicious PowerShell/cmd/VB/Python execution, Windows service and Winlogon persistence, browser credential access, keylogging indicators, screen capture activity, suspicious file timestamp changes, and network traffic that blends into legitimate protocols. This is also useful audit evidence: it tests whether controls cover behavior chains, not just known indicators.

Technical view

The official object has no ATT&CK detection text, so defenders should build validation around the linked techniques and the Windows platform. Focus on behavior correlation: script or shell execution followed by discovery commands, file enumeration, credential collection activity, persistence changes, tool transfer, and suspicious outbound command-and-control patterns. Because KeyBoy is related to Protocol or Service Impersonation, network detections should not rely only on protocol labels; validate whether traffic content, destinations, timing, and process ancestry are inspected where appropriate. Relationship context also notes Tropic Trooper uses this object, but the supplied data does not justify asserting local exposure or current activity.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry for PowerShell, cmd, Visual Basic-related execution, and Python where present
  • Script block, module, and command execution logs where enabled for PowerShell and other interpreters
  • Windows service creation/modification events and related registry/file path evidence
  • Registry monitoring for Winlogon-related persistence locations
  • File system metadata and forensic evidence for timestomping, encoded/encrypted artifacts, new files, and directory enumeration

Detection direction

  • Validate detections against the full behavior chain rather than the malware name alone, since the official ATT&CK object provides no detection guidance.
  • Correlate Windows execution telemetry with subsequent discovery, credential access, collection, persistence, and outbound network activity to reduce false positives from legitimate administration.
  • Tune PowerShell, cmd, VB, and Python analytics carefully; these tools may be legitimate, so process ancestry, user context, execution location, command content, and follow-on behavior are important.
  • Check for Windows service and Winlogon persistence changes from unusual parent processes or user contexts.
  • Review whether endpoint tools can identify or preserve evidence of timestamp manipulation and hidden-window execution, which can weaken simple file-age or user-visible activity assumptions.

Mitigation priorities

  • Start with telemetry readiness on Windows endpoints: process creation, script execution, registry changes, service changes, file metadata, credential access signals, and network egress visibility.
  • Harden scripting and command execution paths with least privilege, administrative control, and logging policies appropriate to the environment.
  • Restrict and monitor persistence locations associated with Windows services and Winlogon helper mechanisms.
  • Reduce credential exposure by strengthening browser credential handling policies, privileged access controls, and rapid credential rotation procedures during suspected compromise.
  • Segment and monitor outbound network access so suspicious tool transfer and command-and-control behavior can be investigated quickly.
Additional notes and limits

KeyBoy is described by MITRE as malware used in targeted campaigns against members of the Tibetan Parliament in 2016, with external references from Citizen Lab, PwC, Rapid7, and MITRE. ATT&CK also records a relationship where Tropic Trooper uses this object, and multiple technique relationships that describe how the malware has been observed behaving. The most defensible use of this entry for a SOC or risk program is as a Windows behavior-coverage test and incident-scoping guide.

The supplied object does not include official ATT&CK detection text, aliases, labels, or object-level tactics. It supports Windows as the platform for KeyBoy, but related techniques may list additional platforms that should not be treated as KeyBoy platform claims. This take does not assert active exploitation, current targeting, attribution beyond the supplied relationship, or guaranteed detectability. Local telemetry, asset exposure, and incident evidence are required to determine relevance in a specific environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

KeyBoy

KeyBoy is malware that has been used in targeted campaigns against members of the Tibetan Parliament in 2016.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1016System Network Configuration Discovery

KeyBoy can determine the public or WAN IP address for the system.[2]

EnterpriseT1082System Information Discovery

KeyBoy can gather extended system information, such as information about the operating system and memory.[2][3]

EnterpriseT1543.003Windows ServiceSub-technique

KeyBoy installs a service pointing to a malicious DLL dropped to disk.[3]

EnterpriseT1059.006PythonSub-technique

KeyBoy uses Python scripts for installing files and performing execution.[1]

EnterpriseT1564.003Hidden WindowSub-technique

KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload. [2]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.[2]

EnterpriseT1056.001KeyloggingSub-technique

KeyBoy installs a keylogger for intercepting credentials and keystrokes.[3]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.[1]

EnterpriseT1070.006TimestompSub-technique

KeyBoy time-stomped its DLL in order to evade detection.[2]

EnterpriseT1105Ingress Tool Transfer

KeyBoy has a download and upload functionality.[2][3]

EnterpriseT1083File and Directory Discovery

KeyBoy has a command to launch a file browser or explorer on the system.[2]

EnterpriseT1059.005Visual BasicSub-technique

KeyBoy uses VBS scripts for installing files and performing execution.[1]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.[2]

EnterpriseT1059.001PowerShellSub-technique

KeyBoy uses PowerShell commands to download and execute payloads.[2]

EnterpriseT1113Screen Capture

KeyBoy has a command to perform screen grabbing.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

KeyBoy can launch interactive shells for communicating with the victim machine.[2][3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

KeyBoy attempts to collect passwords from browsers.[3]

EnterpriseT1547.004Winlogon Helper DLLSub-technique

KeyBoy issues the command reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” to achieve persistence.[2] [1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0081: Tropic Trooper

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1001.003: Protocol or Service ImpersonationEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1559.002: Dynamic Data ExchangeEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1547.004: Winlogon Helper DLLEnterpriseuses · GroupG0081: Tropic TrooperEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
bbbcb835d49b9d22...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundlebbbcb835d49b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  2. [2]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  3. [3]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  4. [4]
    Unit 42 Tropic Trooper Nov 2016

    Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.

    Open source URL
  5. [5]
    CitizenLab Tropic Trooper Aug 2018

    Alexander, G., et al. (2018, August 8). Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces. Retrieved June 17, 2019.

    Open source URL
  6. [6]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  7. [7]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  8. [8]
    KeyBoy

    (Citation: PWC KeyBoys Feb 2017)(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Rapid7 KeyBoy Jun 2013)

  9. [9]
    KeyBoy

    (Citation: PWC KeyBoys Feb 2017)(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Rapid7 KeyBoy Jun 2013)

  10. [10]
    KeyBoy

    (Citation: PWC KeyBoys Feb 2017)(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Rapid7 KeyBoy Jun 2013)

  11. [11]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  12. [12]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  13. [13]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  14. [14]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  15. [15]
    mitre-attackS0387
    Open source URL
  16. [16]
    mitre-attackS0387
    Open source URL
  17. [17]
    mitre-attackS0387
    Open source URL
  18. [18]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  19. [19]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  20. [20]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  21. [21]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  22. [22]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  23. [23]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  24. [24]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  25. [25]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  26. [26]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  27. [27]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  28. [28]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  29. [29]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  30. [30]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  31. [31]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  32. [32]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  33. [33]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  34. [34]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  35. [35]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  36. [36]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  37. [37]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  38. [38]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  39. [39]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  40. [40]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  41. [41]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  42. [42]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  43. [43]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  44. [44]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  45. [45]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  46. [46]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  47. [47]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  48. [48]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  49. [49]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  50. [50]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  51. [51]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  52. [52]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  53. [53]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  54. [54]
    Rapid7 KeyBoy Jun 2013

    Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.

    Open source URL
  55. [55]
    CitizenLab KeyBoy Nov 2016

    Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.

    Open source URL
  56. [56]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use