Trojanized KeePass opens doors for ransomware attackers

A suspected initial access broker has been leveraging trojanized versions of the open-source KeePass password manager to set the stage for ransomware attacks, WithSecure researchers have discovered. KeeLoader: Passoword manager that acts as data stealer and malware loader In February 2025, WithSecure’s inicident responders were hired by an European IT service provider to help with response and remediation after a ransomware gang encrypted their VMware ESXi servers’ datastores. While the attack itself was relatively typical, … More →

The post Trojanized KeePass opens doors for ransomware attackers appeared first on Help Net Security.