APT / THREAT GROUP

KPOT Stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

KPOT is an information-stealing Trojan horse that can steal information from infected computers. It is distributed through phishing emails and malicious websites. Once executed on a computer, KPOT can steal passwords, credit card numbers, and other personal information.

Threat Analysis

KPOT Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blag.nullteilerfrei.de/2020/04/26/use-ghidra-to-decrypt-strings-of-kpotstealer-malware/

→https://blog.ensilo.com/game-of-trojans-dissecting-khalesi-infostealer-malware

→https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/kpot2/KPOT.md

→https://isc.sans.edu/diary/25934

→https://isc.sans.edu/diary/26010

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

KpotKhalesiwin.kpot_stealerKPOT Stealer

External Intelligence

Malpedia: win.kpot_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KPOT Stealer