Khalesi Malware
Published: 12/16/2025
Written by: Lizzie Danielson
What is Khalesi Malware?
Khalesi malware is a sophisticated trojan designed to steal sensitive data, compromise systems, and bypass traditional security measures. Known aliases include Trojan.Win32.Khalesi and other derivatives. It is primarily used as a data exfiltration tool and has a high threat level due to its advanced evasion techniques.
When was Khalesi first discovered?
Khalesi was first identified in 2021 by independent cybersecurity researchers analyzing new trojan variants in the wild. Its discovery highlighted evolving hacker strategies.
Who created Khalesi?
The identities and number of individuals behind Khalesi remain unknown. However, its complexity suggests involvement by a highly skilled threat actor or group.
What does Khalesi target?
Khalesi primarily targets Windows-based systems across industries such as finance, healthcare, and government. Its geographic reach has been global, raising concerns among organizations worldwide.
Khalesi distribution method
Khalesi malware often spreads through phishing emails embedded with malicious attachments or links. Additional methods include drive-by downloads and exploit kits delivered via compromised websites.
Technical analysis of Khalesi malware
Once executed, Khalesi begins by establishing persistence through registry edits and scheduled tasks. It employs encryption to evade detection and communicates with command-and-control servers to exfiltrate data. Advanced obfuscation techniques allow it to remain hidden while extracting valuable files.
Tactics, Techniques & Procedures (TTPs)
MITRE ATT&CK Techniques:
T1203 (Exploitation of Vulnerability)
T1071 (Application Layer Protocol)
T1547 (Persistence via Registry Run Keys)
Indicators of Compromise (IoCs)
Malicious IPs and domains associated with Khalesi C2 servers
Unique hashes of known Khalesi payloads (e.g., MD5 and SHA256)
Unusual system processes or registry changes
How to know if you’re infected with Khalesi?
If your system experiences unexplained slowdowns, unusual outbound network activity, or you detect unfamiliar processes in task management, you may be infected. Infosec teams should monitor critical systems for signs of unauthorized access.
Khalesi removal instructions
Manual removal requires disconnecting the affected device, identifying malicious processes, and deleting registry edits. However, using advanced tools like Huntress EDR provides safer and more effective remediation options by restoring your system and preventing further damage.
Is Khalesi still active?
Khalesi remains an active threat, with variants frequently appearing in threat intelligence reports. Staying protected requires continuous monitoring and updated defenses.
Mitigation & prevention strategies
To prevent Khalesi infections, apply email filtering, enable MFA, and prioritize user security awareness training.
Related educational articles & videos
Frequently Asked Questions about Khalesi
Organizations can protect themselves by implementing strong email monitoring, using endpoint detection and response (EDR) tools, training employees on phishing awareness, and maintaining proper patch management.
Protect What Matters
