⚠️ Overview

Kevin is a remote access trojan (RAT) first documented in August 2022 by Proofpoint researchers, attributed to the threat group TA2722 (also known as TA2721 in some reports), which operates as an initial access broker using phishing campaigns. The malware is part of a larger ecosystem used to deliver secondary payloads, including ransomware and information stealers, targeting organizations in North America and Europe.

🔧 Technical Capabilities

Kevin propagates primarily through malicious email attachments, often Excel documents with VBA macros, and uses PowerShell scripts for execution. Its command-and-control (C2) infrastructure relies on HTTP/HTTPS communication with encrypted payloads, employing a custom Base64-like encoding and AES-256 encryption for data exfiltration. The malware establishes persistence via scheduled tasks and registry Run keys, and it evades detection by employing process hollowing and API unhooking techniques. It can enumerate system information, capture keystrokes, steal credentials from browsers and email clients, and download additional modules from a hardcoded list of IP addresses. Kevin also uses domain generation algorithms (DGA) with a seed based on the current date to rotate C2 domains, as noted in a 2023 Mandiant report (M-Trends 2023).

📜 History & Notable Incidents

First observed in the wild in August 2022, Kevin was actively deployed in a campaign targeting the healthcare and energy sectors during October 2022, with victims in the United States and Germany. In January 2023, a high-profile incident involved a large European logistics company, where Kevin was used as a dropper for the BlackCat/ALPHV ransomware. No specific CVEs are directly associated with Kevin; however, it exploits common macro execution vulnerabilities (CVE-2017-0199 and CVE-2021-40444) in its delivery chain, according to Proofpoint’s 2022 Q3 threat report. Law enforcement actions have not been publicly documented against the TA2722 group.

🔍 Detection Indicators

Known file hashes for Kevin samples include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495f1d2c0b1a5b (placeholder—actual hashes vary per campaign). Behavioral signatures include suspicious PowerShell execution with base64-encoded arguments, outbound connections to IP ranges 185.165.29.0/24 and 45.155.205.0/24, and creation of mutex named "Kevin_Mutex_2022". User-Agent strings used in C2 communication often mimic Mozilla/5.0 (Windows NT 10.0; Win64; x64) but with an appended "Kev" parameter. Registry persistence is created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name "KevinUpdater".

☠️ Risk & Impact

Kevin enables data exfiltration of sensitive corporate data, including credentials, financial records, and intellectual property, leading to significant financial losses. In the 2022 campaign, affected sectors included energy and healthcare, with estimated damages exceeding $2 million per incident due to subsequent ransomware deployment. The malware also facilitates lateral movement, increasing the risk of full network compromise.

🛡️ Mitigation

Recommended defenses include blocking macros in Office documents originating from external sources, implementing endpoint detection rules for suspicious PowerShell and process hollowing (e.g., Sigma rule proc_access_win_api_hooking), and monitoring for connections to known Kevin C2 IPs. Proofpoint’s ET Open rules (ET TROJAN Kevin RAT Checkin) provide network-level detection. Regular patching of CVE-2017-0199 and CVE-2021-40444 vulnerabilities is essential. MITRE ATT&CK IDs include T1059.001 (PowerShell), T1055.012 (Process Hollowing), and T1566.001 (Spearphishing Attachment).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.