KeyPlug Server Leak Reveals Fortinet Exploits

Cybersecurity researchers recently uncovered a server linked to the KeyPlug malware, used by the threat group RedGolf (also known as APT41). The server was accidentally exposed for less than 24 hours but revealed valuable insight into the group’s advanced attack methods.

KeyPlug Server Malware

The exposed server appeared to be a staging area for active cyberattacks. Among the tools found were scripts targeting Fortinet firewalls and VPNs.

One of the key discoveries was a Python script named 1.py, which scans Fortinet devices to identify version-specific JavaScript hash values. This helps attackers choose the most effective exploit for each system.

The leak offers a rare look into the inner workings of a sophisticated threat group and highlights the ongoing risk to enterprise security infrastructure.

Further analysis uncovered script.py, used to identify internet-facing CDN systems, and ws_test.py, which exploits Fortinet WebSocket CLI flaws by spoofing local IPs to bypass access controls and run commands without authentication.

Malicious Tools Found in KeyPlug Server Leak

The leaked server also contained bx.php, an encrypted PHP webshell used for remote command execution. It decrypts commands in real time, making activity harder to trace.

Another file, client.ps1, was a PowerShell reverse shell that maintains encrypted communication over TCP for stealthy post-exploitation control.

An ELF binary named Server was also found, acting as an HTTP listener on port 8080. It lets attackers manage sessions, send commands, and control compromised systems.

This brief exposure gave researchers a rare look at the advanced tools used by RedGolf/APT41. It also highlights the need to monitor for even short-lived malicious infrastructure and ensure Fortinet systems—especially SSL VPNs—are fully patched.

Security teams should watch for signs of automated access attempts or unusual activity that may signal similar reconnaissance or attacks.

Indicators of Compromise (IOCs)

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!