How to Track Actors Behind Keyloggers Using Embedded Credentials
Summary: Unit 42 analyzed 500 recent HawkEye and iSpy samples exhibiting FTP or SMTP activity and parsed the credentials embedded in the binaries to correlate actors, identifying four distinct clusters. One FTP drop site at 108.179.196[.]24 was the most used, with 71 unique samples and 18 unique FTP accounts, and 14 usernames there shared the password "joinkrama2".
Key Takeaway: The actors behind these keyloggers embed their own FTP and SMTP usernames and passwords in plaintext inside the malware, and their operational security failures - reused passwords like "pentium12345" and "joinkrama2", shared username patterns, and domains registered to one registrant in Nigeria - are what made attribution possible across 500 samples.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026