TerraLogger

TerraLogger is a standalone Windows keylogger malware family attributed to the Golden Chickens malware-as-a-service ecosystem, also known as Venom Spider/TA4557. It was reported by Recorded Future Insikt Group and observed in samples uploaded in early 2025, with activity and sample compilation timestamps spanning January to April 2025. The malware is described as Venom Spider’s first observed keylogging capability and appears to be under active development.

Its core functionality is keystroke capture via a low-level keyboard hook implemented with SetWindowsHookExA using WH_KEYBOARD_LL. TerraLogger records keystrokes locally to files under C:\ProgramData, including filenames such as a.txt and save.txt, and reporting also notes detections based on specific file creation events. It records window titles along with keystrokes, including handling of special characters and Shift key states, and may represent special keys using formats such as <KEY-[keycode]> or pipe-delimited abbreviations like |bck|. One mention also describes clipboard monitoring, but the strongest repeated reporting consistently characterizes it as a keylogger focused on keystroke logging to local files.

TerraLogger does not include built-in data exfiltration or command-and-control functionality in the reported samples, which suggests either early-stage development or intended modular use alongside other Golden Chickens components. It has been described as a standalone module and as less mature than established Golden Chickens tooling such as TerraLoader and VenomLNK.

Delivery and execution details in the reporting indicate TerraLogger is propagated as an OCX payload and executed via regsvr32.exe, consistent with Golden Chickens tradecraft. Related reporting states the newer Golden Chickens families employ evasion techniques including execution via trusted Windows utilities such as regsvr32.exe, and in broader campaign context Golden Chickens has also used mshta.exe. TerraLogger samples showed minor updates over time, including changes to log file paths and special-key representations.

The malware is associated with the financially motivated Golden Chickens/Venom Spider MaaS operation, whose tooling has been used by groups including FIN6, Cobalt Group, and Evilnum. High-confidence indicators and artifacts directly mentioned for TerraLogger include use of SetWindowsHookExA with WH_KEYBOARD_LL, local log storage in C:\ProgramData, filenames such as a.txt and save.txt, OCX-based delivery, and execution via regsvr32.exe.