Key Boy

KeyBoy is a Chinese advanced persistent threat designation associated with espionage activity primarily targeting organizations in East Asia. It has been discussed as related to TA428, Pirate Panda, and Tropic Trooper, with reported tradecraft overlap also noted with Royal Road Group-B activity clusters such as Tick and Tonto. The available reporting supports treating KeyBoy as part of a broader Chinese intrusion ecosystem focused on government targets. Activity associated with this cluster has used spearphishing documents themed around geopolitical and public-health topics to gain initial access, including Microsoft Word exploitation of CVE-2018-0798. Post-compromise behavior includes persistence through malicious Word add-ins, deployment of Poison Ivy and Cotx RAT, DLL sideloading using legitimate signed executables, credential theft from Outlook and LSASS, internal reconnaissance, and lateral movement using tooling derived from public MS17-010 scanning and exploitation code. Operators have also injected malware into LSASS, deployed additional remote access trojans including Tmanger and nccTrojan, and used capabilities such as command execution, file operations, screen capture, keylogging, and remote shell access. The actor demonstrates mature post-exploitation tradecraft, including defense evasion, process injection, persistence, and multi-stage malware deployment against government organizations in East Asia.