HOMETHREATSPhoenix Keylogger
APT / THREAT GROUP

Phoenix Keylogger

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Keylogger, information stealer.

Threat Analysis

Phoenix Keylogger is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/
→https://news.sophos.com/en-us/2022/08/18/cookie-stealing-the-new-perimeter-bypass
→https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/
→https://www.cybereason.com/blog/phoenix-the-tale-of-the-resurrected-alpha-keylogger

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Phoenix Keyloggerwin.phoenix_keylogger

External Intelligence

Malpedia: win.phoenix_keylogger

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Phoenix Keylogger