APT / THREAT GROUP

404 Keylogger

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victim’s sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.

Threat Analysis

404 Keylogger is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://any.run/cybersecurity-blog/analyzing-snake-keylogger/

→https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/

→https://blog.netlab.360.com/purecrypter

→https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/

→https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

Snake Keylogger404 Keyloggerwin.404keylogger404KeyLogger

External Intelligence

Malpedia: win.404keylogger

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search 404 Keylogger