Loading malware…
Kevin is a Windows malware family associated with command-and-control over DNS and covert data exfiltration. It can transmit data from compromised hosts through a DNS-based C2 channel and exfiltrate information in small fixed-size chunks, including Base32-encoded chunks of output files, indicating an emphasis on fitting data into constrained protocol fields and reducing visibility. The malware also uploads logs and other collected data to its operators and supports hard-coded fallback domains to preserve C2 resiliency when primary infrastructure is unavailable.
Kevin incorporates multiple defense-evasion features. It can hide its active window from the victim by calling the ShowWindow API, generate dummy HTTP requests to obscure malicious traffic patterns, and delay between C2 communication attempts by sleeping for configurable intervals. It also uses masquerading-related tradecraft by renaming an image of cmd.exe with a randomized name and a nonstandard extension to reduce detection.
For persistence, Kevin can compile randomly generated MOF files into the Windows Management Instrumentation repository, enabling malware execution through WMI-based mechanisms. The observed behaviors support characterization of Kevin as a backdoor-oriented implant focused on stealthy communications, persistence, and exfiltration on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
Kevin can sleep for a time interval between C2 communication attempts.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
AppleSeed has divided files if the size is 0x1000000 bytes or more. APT28 has split archived exfiltration files into chunks smaller than 1MB. APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.
Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server. Kevin can exfiltrate data to the C2 server in 27-character chunks. OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels... CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader... Kevin can send data from the victim host through a DNS C2 channel... NightClub can use SMTP and DNS for file exfiltration and C2.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware that hides its current window using the ShowWindow API.
Malware that persists by compiling randomly generated MOF files into the WMI repository.
Backdoor malware that exfiltrates data to command-and-control in 27-character chunks.
Malware that Base32-encodes chunks of output files during exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.