MalwareUsed by 2 actors

CWoolger

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Magic Hound

Magic Hound used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.

via mitre attack websiteattack.mitre.org

Ajax Security

Once executed, the file drops a nonmalicious PowerPoint file used as a decoy file, while silently infecting the system with a variant of the CWoolger keylogger.

via trendmicro documentsdocuments.trendmicro.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

The attackers used a OneDrive link in their campaign... The OneDrive link leads to an archive file containing a file named, “Iran’s Missiles Program.ppt.exe.”

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

It then enables keylogging by calling the SetWindowsHookExW application programming interface (API) and calls SetTimer API to prepare a timer job for uploading the log files.

T1059Command and Scripting InterpreterEvidence1

The malware starts by creating a mutex called “woolger” and creates a copy of itself, %TEMP%\NTSuser.exe, in the TEMP folder before executing it. It creates a VBScript in the same folder named “wsc.vbs.”

T1204.001Malicious LinkEvidence1

Several social engineering tricks can be used to make a user click a link or open a file.

T1204.002Malicious FileEvidence1

When a user opens the Excel file attachment in the spear-phishing attempt, a .DLL file is dropped onto the system and is executed using a macro embedded in the file.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

It then enables keylogging by calling the SetWindowsHookExW application programming interface (API) and calls SetTimer API to prepare a timer job for uploading the log files.

T1547.001Registry Run Keys / Startup FolderEvidence1

The script installs the persistence mechanism of the malware, a link named, “WinDefender,” in the startup folder, which uses the Notepad icon.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

It then enables keylogging by calling the SetWindowsHookExW application programming interface (API) and calls SetTimer API to prepare a timer job for uploading the log files.

T1547.001Registry Run Keys / Startup FolderEvidence1

The script installs the persistence mechanism of the malware, a link named, “WinDefender,” in the startup folder, which uses the Notepad icon.

Stealth

2 techniques

T1036MasqueradingEvidence1

The OneDrive link leads to an archive file containing a file named, “Iran’s Missiles Program.ppt.exe.” This file... used the PowerPoint icon but was really an executable file.

T1070.004File DeletionEvidence1

OneDrive link leads to an archive file containing a file named, “Iran’s Missiles Program.ppt.exe.” This file, which has been taken offline

Credential Access

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Collection

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Command and Control

2 techniques

T1071.002File Transfer ProtocolsEvidence1

The credentials used to connect with the FTP server are hard-coded in clear text in the binary.

T1105Ingress Tool TransferEvidence1

The attackers probably decided to store their malicious binaries online rather than sent them as an attachment to bypass email detection.

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

If the log file is larger than 3,000 bytes, an uploadToCnC function will be called to transfer the log file via FTP.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app—

ip.v4●●●●●●●●●●●●View more in app—

hash.sha1●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attack websiteNews

Jan 1, 2021

Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®

Custom-developed malware used to record all keystrokes on infected systems.

mitre attackNews

Jan 25, 2026

Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®

Custom-developed malware used to record all keystrokes on infected systems.

trendmicro documentsNews

Aug 14, 2026

A keylogger associated with Operation Woolen-GoldFish and linked to the developer handle Wool3n.H4t. It creates persistence via VBScript and a startup link, logs keystrokes to a temp file, and uploads stolen logs via FTP to a hard-coded IP address using embedded credentials.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

CWoolger

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Magic Hound

Magic Hound used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.

via mitre attack websiteattack.mitre.org

Ajax Security

Once executed, the file drops a nonmalicious PowerPoint file used as a decoy file, while silently infecting the system with a variant of the CWoolger keylogger.

via trendmicro documentsdocuments.trendmicro.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

The attackers used a OneDrive link in their campaign... The OneDrive link leads to an archive file containing a file named, “Iran’s Missiles Program.ppt.exe.”

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

It then enables keylogging by calling the SetWindowsHookExW application programming interface (API) and calls SetTimer API to prepare a timer job for uploading the log files.

T1059Command and Scripting InterpreterEvidence1

T1204.001Malicious LinkEvidence1

Several social engineering tricks can be used to make a user click a link or open a file.

T1204.002Malicious FileEvidence1

When a user opens the Excel file attachment in the spear-phishing attempt, a .DLL file is dropped onto the system and is executed using a macro embedded in the file.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

It then enables keylogging by calling the SetWindowsHookExW application programming interface (API) and calls SetTimer API to prepare a timer job for uploading the log files.

T1547.001Registry Run Keys / Startup FolderEvidence1

The script installs the persistence mechanism of the malware, a link named, “WinDefender,” in the startup folder, which uses the Notepad icon.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

It then enables keylogging by calling the SetWindowsHookExW application programming interface (API) and calls SetTimer API to prepare a timer job for uploading the log files.

T1547.001Registry Run Keys / Startup FolderEvidence1

The script installs the persistence mechanism of the malware, a link named, “WinDefender,” in the startup folder, which uses the Notepad icon.

Stealth

2 techniques

T1036MasqueradingEvidence1

The OneDrive link leads to an archive file containing a file named, “Iran’s Missiles Program.ppt.exe.” This file... used the PowerPoint icon but was really an executable file.

T1070.004File DeletionEvidence1

OneDrive link leads to an archive file containing a file named, “Iran’s Missiles Program.ppt.exe.” This file, which has been taken offline

Credential Access

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Collection

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Command and Control

2 techniques

T1071.002File Transfer ProtocolsEvidence1

The credentials used to connect with the FTP server are hard-coded in clear text in the binary.

T1105Ingress Tool TransferEvidence1

The attackers probably decided to store their malicious binaries online rather than sent them as an attachment to bypass email detection.

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

If the log file is larger than 3,000 bytes, an uploadToCnC function will be called to transfer the log file via FTP.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app—

ip.v4●●●●●●●●●●●●View more in app—

hash.sha1●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attack websiteNews

Jan 1, 2021

Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®

Custom-developed malware used to record all keystrokes on infected systems.

mitre attackNews

Jan 25, 2026

Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK®

Custom-developed malware used to record all keystrokes on infected systems.

trendmicro documentsNews

Aug 14, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.