Once an attack succeeds, TA558 deploys multiple types of malware on victim machines — including AsyncRAT, LodaRAT, RevengeRAT, XWorm, and AgentTesla — for remote computer control and information theft.
LodaRAT
LodaRAT is a long-running remote access trojan and information-stealing malware family, active since at least 2016–2017, primarily associated with Windows and later expanded to Android through the related Loda4Android variant.
Profile source: Mallory opens in a new tabLodaRAT
Family profile
LodaRAT is a long-running remote access trojan and information-stealing malware family, active since at least 2016–2017, primarily associated with Windows and later expanded to Android through the related Loda4Android variant. The Windows malware is written in AutoIt and has been used for remote system control, surveillance, credential theft, and broader espionage-oriented collection. Documented capabilities include screenshot capture, keystroke logging, audio recording, browser password and cookie theft, command execution, and persistence. More recent reporting also attributes to some variants the ability to disable host defenses, create user accounts, enable remote desktop access, and attempt lateral movement over SMB. Android variants add mobile surveillance and collection functions such as location tracking, ambient audio recording, photo and screenshot capture, SMS, call log, and contact theft, as well as command execution and phishing functionality.
LodaRAT has been delivered through multiple infection chains over time. Observed Windows delivery methods include phishing emails carrying malicious Office documents, exploit-based chains using CVE-2017-0199 and CVE-2017-11882, compressed archives containing executable payloads, and lure websites serving password-protected archives. Campaigns have also used fake or impersonating websites themed around government, telecom, finance, political, and public-service subjects to target victims. Newer distribution has included renamed RAR archives requiring user execution, and some reporting links delivery to additional tooling such as DonutLoader and Cobalt Strike.
Operational use of LodaRAT spans both commodity cybercrime and targeted espionage. It has been deployed by TA558 in phishing campaigns affecting Latin America and other regions, used by YoroTrooper in espionage activity targeting government and energy organizations in CIS countries, and linked by Cisco Talos to a cluster it tracks as Kasablanca in campaigns targeting Bangladesh. Kasablanca-linked activity has been assessed as information-gathering focused and possibly consistent with cyber-mercenary or hacker-for-hire tradecraft, although that characterization is not conclusive. Targeting associated with LodaRAT has included hospitality, tourism, finance, government, energy, education, IT, pharmaceuticals, transportation, banks, VoIP vendors, diplomatic entities, and other organizations.
The malware’s command-and-control tradecraft has evolved over time and has included abuse of legitimate tunneling or port-forwarding services to obscure infrastructure. Multiple versions have been observed in parallel, with differing feature sets and code quality, suggesting either active development, reuse by multiple operators, or both. Despite these variations, LodaRAT remains best characterized as a versatile RAT used for remote access, surveillance, credential theft, and post-compromise collection across Windows and Android environments.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Keylogging
- Lateral Movement
- Persistence
- Post Exploitation
- Reconnaissance
- Spoofing
Reported operators
Threat actors
4 named in public reportingLodaRAT, or Loda, is information gathering malware. It has the ability to take screenshots of infected machines, record keystrokes and sound and allows its operators to send commands to the machine.
The developers of LodaRAT have added Android as a targeted platform. A new iteration of LodaRAT for Windows has been identified with improved sound recording capabilities.
YoroTrooper has relied heavily on the use of primarily two commodity malware families, AveMaria/Warzone RAT and LodaRAT, especially in October and November 2022.
Exploited software
Vulnerabilities linked to LodaRAT
2 CVEsMITRE ATT&CK
LodaRAT in ATT&CK
29 distinct techniquesTechniques
29 techniques T1219 Remote Access Tools T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1560 Archive Collected Data T1056.001 Keylogging T1059.005 Visual Basic T1113 Screen Capture T1082 System Information Discovery T1071 Application Layer Protocol T1566 Phishing T1059 Command and Scripting Interpreter T1036 Masquerading T1059.001 PowerShell T1497.001 System Checks T1204 User Execution T1566.002 Spearphishing Link T1555 Credentials from Password Stores T1123 Audio Capture T1547.001 Registry Run Keys / Startup Folder T1090.002 External Proxy T1204.002 Malicious File T1105 Ingress Tool Transfer T1112 Modify Registry T1059.007 JavaScript T1218.010 Regsvr32 T1136 Create Account T1562 Impair Defenses T1021.001 Remote Desktop Protocol T1041 Exfiltration Over C2 Channel
