Data by Hatching Triage Windows

Pikabot

PikaBot is a Windows malware family first observed in 2023 and primarily used as a modular loader with backdoor functionality.

Profile source: Mallory

Pikabot

Family profile

PikaBot is a Windows malware family first observed in 2023 and primarily used as a modular loader with backdoor functionality. It is commonly structured as a two-part system consisting of a loader or injector and a core module. The loader is responsible for decrypting and launching the core, often by injecting it into legitimate Windows processes to reduce visibility, while the core handles command-and-control communications, host profiling, command execution, and delivery of additional payloads. Reported follow-on payloads and ecosystem associations include Cobalt Strike and ransomware operations, and the malware has been used by intrusion clusters and criminal operators including TA577 and Black Basta.

PikaBot is designed for stealth and anti-analysis. Public analyses have documented anti-debugging checks, anti-virtualization logic, language-based execution restrictions that avoid some CIS-region systems, API hashing, junk code insertion, encrypted stack strings, and evolving string-obfuscation schemes using RC4 and, in earlier variants, Base64 and AES-CBC. Some variants also use indirect syscalls and process injection to conceal malicious activity. The malware has been observed masquerading as legitimate Microsoft components and using legitimate signed installers or signed binaries in some campaigns.

The core module supports arbitrary command execution, process enumeration, system reconnaissance, and payload delivery. Documented capabilities include collecting host and domain information, enumerating running processes, executing shell commands, downloading and running executable or DLL payloads, injecting PE payloads or shellcode, and writing files or registry-backed data for persistence or staging. Network communications have been observed over HTTP or HTTPS using encrypted or encoded application-layer protocols, with protocol details changing across versions.

PikaBot has been distributed through multiple delivery chains. The most consistently reported vector is thread-hijacking email campaigns in which victims are lured to retrieve archives containing JavaScript or other script-based downloaders. Additional observed delivery mechanisms include malspam, malicious ads impersonating legitimate software brands, ZIP-contained JavaScript droppers, VBS downloaders, LNK downloaders, and signed MSI-based installers. Some campaigns used restrictive filtering and fingerprinting before payload delivery. The malware has also appeared in operations that resembled historical QakBot tradecraft, although direct authorship overlap has not been conclusively established.

Operationally, PikaBot has been linked to initial-access and malware-delivery ecosystems rather than standalone monetization. It has been used to establish footholds that enable post-exploitation activity and deployment of secondary tooling. Law-enforcement reporting tied it to Operation Endgame disruptions in 2024 alongside other major loader and botnet families, underscoring its role in the broader cybercrime access market.

Capabilities

Defense Evasion
Initial Access
Persistence
Post Exploitation
Process Injection
Reconnaissance

Reported operators

Threat actors

3 named in public reporting

TA577

It was quickly nicknamed Pikabot. Pikabot consists of two components: loader/injector and core module. Core module then performs malicious behaviors, including gathering information about the victim machine, connecting to command and control server to receive and execute arbitrary commands, downloading and injecting other malware.

Black Basta

Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns.

WIZARD SPIDER

...new malware strains such as ... Pikabot ...

MITRE ATT&CK

Pikabot in ATT&CK

72 distinct techniques

Techniques

72 techniques

T1497 Virtualization/Sandbox Evasion T1622 Debugger Evasion T1497.001 System Checks T1553.002 Code Signing T1046 Network Service Discovery T1071 Application Layer Protocol T1059.007 JavaScript T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter T1140 Deobfuscate/Decode Files or Information T1059.005 Visual Basic T1218 System Binary Proxy Execution T1027 Obfuscated Files or Information T1204 User Execution T1055 Process Injection T1480.002 Mutual Exclusion T1016 System Network Configuration Discovery T1132 Data Encoding T1033 System Owner/User Discovery T1566 Phishing T1036 Masquerading T1573 Encrypted Channel T1189 Drive-by Compromise T1204.002 Malicious File T1560 Archive Collected Data T1057 Process Discovery T1071.001 Web Protocols T1654 Log Enumeration T1614.001 System Language Discovery T1049 System Network Connections Discovery T1053.005 Scheduled Task T1082 System Information Discovery T1218.010 Regsvr32 T1129 Shared Modules T1547.009 Shortcut Modification T1566.002 Spearphishing Link T1586.002 Email Accounts T1547 Boot or Logon Autostart Execution T1112 Modify Registry T1059.001 PowerShell T1583 Acquire Infrastructure T1027.013 Encrypted/Encoded File T1083 File and Directory Discovery T1027.007 Dynamic API Resolution T1547.001 Registry Run Keys / Startup Folder T1543 Create or Modify System Process T1027.009 Embedded Payloads T1482 Domain Trust Discovery T1106 Native API T1218.011 Rundll32 T1202 Indirect Command Execution T1027.002 Software Packing T1518 Software Discovery T1055.012 Process Hollowing T1056 Input Capture T1070.004 File Deletion T1571 Non-Standard Port T1620 Reflective Code Loading T1204.001 Malicious Link T1001 Data Obfuscation T1059.003 Windows Command Shell T1560.001 Archive via Utility T1041 Exfiltration Over C2 Channel T1027.003 Steganography T1027.011 Fileless Storage T1055.002 Portable Executable Injection T1087.001 Local Account T1573.001 Symmetric Cryptography T1132.001 Standard Encoding T1055.003 Thread Execution Hijacking T1480.001 Environmental Keying

Reporting

Research mentioning Pikabot

Aug 15

Github Web

GitHub - tjnel/certgraveyard_yara: Automated YARA rule generation from the Cert Central compromised certificate database. · GitHub

A public project called CertGraveyard has expanded efforts to document abused code-signing certificates used to sign malware, building a shared record of certificate abuse and helping defenders trigger revocations with certificate authorities. The project’s creator said the initiative grew out of years of reporting malicious certificates tied to malware such as SolarMarker, and has helped report more than 2,000 certificates, later growing to roughly 2,400 entries in the database. Supporting tooling includes certReport, which automates abuse reports from malware hashes using sources such as VirusTotal and MalwareBazaar, plus an API, downloadable datasets, feeds, hunting queries, and integrations with platforms including MalwareBazaar, UnpacMe, Malcat, MagicSword.io, and WDAC enforcement workflows. The database reflects a broader pattern in which threat actors repeatedly obtain or abuse valid Authenticode certificates to make malware appear trustworthy, reduce Windows warnings, and sustain delivery campaigns. Prior reporting cited SolarMarker cycling through impostor-issued certificates, FakeBat distributing signed MSI and MSIX installers, Netbounce using valid certificates and fake software branding, Dark Caracal signing Bandook variants with legitimate certificates, and Operation Red Signature abusing a stolen vendor certificate in a supply-chain intrusion. CertGraveyard’s operator said certificate authorities often act on external reports within hours, making revocation a practical disruption measure, though the project has also faced operational pressure including a major DDoS attack while handling heavy daily lookup and download volumes from defenders and malware-analysis integrations.

Aug 11

Lazarusholic Bluesky

Post by @lazarusholic.bsky.social - Bluesky

A Sonatype report identified six malicious npm packages that used Ethereum transactions to retrieve and stage malicious payloads, an unusual delivery method that obscures second-stage infrastructure behind blockchain activity. The campaign was linked in public reporting to ContagiousInterview and NullReceiver, indicating continued abuse of the JavaScript and Node.js ecosystem for software supply-chain compromise. The activity aligns with broader attacker tradecraft documented for MITRE ATT&CK T1059.007 (Command and Scripting Interpreter: JavaScript), which covers JavaScript and Node.js use for payload delivery, execution, reconnaissance, and command-and-control. Defenders monitoring follow-on behavior should watch for suspicious child-process activity and discovery commands launched from non-shell parent processes, a pattern reflected in Splunk detection guidance for tools such as ipconfig.exe, systeminfo.exe, net.exe, and whoami.exe executed outside normal cmd.exe or PowerShell chains.

Jul 28

Sekoia

Exposing FakeBat loader: distribution methods and adversary infrastructure

Jun 23

Github Web

DE-TH-Aura/Defender for Endpoint/ExternalData - Cert Central, CertReport.md at main · SecurityAura/DE-TH-Aura · GitHub

Jun 22

Squiblydoo

Using the Cert Graveyard - Squiblydoo.blog

May 19

Trellix Other

Qakbot Evolves to OneNote Malware Distribution

Qakbot operators repeatedly changed their intrusion chains between March and May 2023, using malspam and a rotating set of attachment and container formats including PDF, HTML, ZIP, OneNote, WSF/HTA, and XLL files to deliver the malware. Researchers observed HTML smuggling, obfuscated JavaScript, PowerShell, and DLL-based payload staging in March, followed by ZIP-to-XLL chains that rebuilt payloads from split DAT files and created scheduled tasks for persistence. By April and May, the malware’s operators had shifted from base64-encoded PowerShell toward hex-encoded XMLHTTP requests delivered through WSF files, and used a OneNote-to-MSI lure posing as a Microsoft Azure installer. Later campaigns added stronger defense evasion, including indirect command execution through conhost.exe, DLL side-loading, and curl-based payload retrieval. Researchers also noted that Pikabot samples seen in mid-May shared similar tradecraft, but said the available evidence did not support attributing both malware families to the same actor.

May 13

Splunk Research