SnakeKeylogger Attack

What is the Attack?

Threat actors are continuously preying on end users to unknowingly install a trojan stealer known as SnakeKeylogger or KrakenKeylogger. This trojan was developed using .NET and targets Windows users. Its arsenal includes keystroke logging, harvesting credentials, and capturing screenshots. Based on the FortiGuard telemetry, there were hundreds of 0-day detection hits. Moreover, the sites that the trojan connects to were queried several times which suggests infection.

What is the recommended Mitigation?

FortiGuard Labs recommends a multi-layered approach to security. Here are some reminders:

• Keep your security services up to date with latest databases and engines.

• Enable Antivirus and Sandbox on security profiles in network policies.

• Use EDR for protecting end users from any pre and post exploitation.

• Be cautious when opening emails, clicking links, and downloading attachments.

What FortiGuard Coverage is available?

• FortiGuard 0-day protection via Sandbox and EDR detects the malicious behavior.

• FortiGuard Antivirus protection detects the trojan as MSIL/Agent.RAT!tr.

• FortiGuard IOC Service blocks access to the payload site as a Spam/Malicious site.

• The FortiGuard Incident Response team can be engaged to help with any suspected compromise.

  To learn more about the SnakeKeylogger trojan, read the Encyclopedia Report posted by FortiGuard Labs at: MSIL/Snake.KEY!tr.dldr; MSIL/Agent.RAT!tr (previous name)