{
  "family": "khalesi",
  "sample_count": 555,
  "category": "infostealer",
  "description": "Backdoor:Win32/Khalesi is a highly capable, modular Remote Access Trojan (RAT) and information stealer utilized by cybercriminals to establish deep persistence and exfiltrate sensitive data.<br><br><b>Understanding Khalesi</b><br>To the victim, Khalesi provides zero indication of infection. For threat intelligence analysts, Khalesi is a dangerous, multi-functional tool. It is designed to act as a silent observer, harvesting keystrokes, capturing screenshots, and extracting credentials from web browsers and email clients before securely transmitting them back to the attacker's infrastructure.<br><br><b>Execution and Evasion Strategies</b><br>Khalesi is distributed through targeted spam campaigns containing malicious attachments or dropped via exploit kits. Upon execution, it copies itself into the <code>%AppData%</code> directory, often masquerading as a legitimate Windows executable. It achieves persistence by modifying the <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code> registry key. Khalesi utilizes advanced code injection, hollowing out legitimate processes (like <code>explorer.exe</code>) to hide its activities. The C2 communications are heavily encrypted and often utilize Domain Generation Algorithms (DGA) to evade network-level blocking.<br><br><b>Indicators of Compromise & Impact</b><br>The impact of Khalesi is a severe breach of confidentiality. The attacker gains full interactive control over the endpoint. Incident responders should monitor for anomalous outbound TCP traffic, particularly to known dynamic DNS providers. The presence of encrypted log files (often <code>.dat</code> or <code>.log</code>) in the user's profile directory, containing captured keystrokes and screenshots, is a strong indicator. Memory forensics is required to extract the unencrypted Khalesi payload and C2 configuration from injected processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1568.002",
    "T1055.012",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly sever the endpoint from the network to halt the active exfiltration of stolen credentials, screenshots, and sensitive files.",
    "Force a global password reset for all user accounts, prioritizing corporate VPN access, email, and financial portals.",
    "Capture a full memory dump of the infected host to extract the injected Khalesi modules and identify the C2 infrastructure.",
    "Rebuild the operating system from a known-clean image, as Khalesi frequently drops secondary backdoors to ensure persistent access."
  ],
  "what_to_avoid": [
    "Do not allow the user to continue working on the infected machine; the active keylogger captures every keystroke, rendering password resets useless if done locally.",
    "Avoid relying solely on static IP blocks for C2 mitigation, as Khalesi utilizes DGAs to rapidly cycle through command domains."
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}