Skip to content

Pikabot

Introducing Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. Despite being in the early stages of development, it already demonstrates advanced techniques in evasion, injection, and anti-analysis. Notably, the loader component incorporates an array of sophisticated anti-debugging and anti-VM measures inspired by the open-source Al-Khaser project, while leveraging steganography to conceal its payload. Additionally, Pikabot utilizes a proprietary C2 framework and supports a diverse range of commands, encompassing host enumeration and advanced secondary payload injection options.

C2 Infrastructure

Hosting/VPS 100%

Last 7 days

Jul 10, 2026
C2 Hosts: 9

Further Reading

blog.cyber5w.com opens in a new tab
blog.cyber5w.com
blog.cyber5w.com opens in a new tab
blog.cyber5w.com
blog.krakz.fr opens in a new tab
blog.krakz.fr
blog.pulsedive.com opens in a new tab
blog.pulsedive.com
blog.securityonion.net opens in a new tab
blog.securityonion.net
blog.sekoia.io opens in a new tab
blog.sekoia.io
blog.sekoia.io opens in a new tab
blog.sekoia.io
cofense.com opens in a new tab
cofense.com
d01a.github.io opens in a new tab
d01a.github.io
github.com opens in a new tab
github.com
info.spamhaus.com opens in a new tab
info.spamhaus.com
kienmanowar.wordpress.com opens in a new tab
kienmanowar.wordpress.com
medium.com opens in a new tab
medium.com
minerva-labs.com opens in a new tab
minerva-labs.com
news.sophos.com opens in a new tab
news.sophos.com
research.openanalysis.net opens in a new tab
research.openanalysis.net
research.openanalysis.net opens in a new tab
research.openanalysis.net
research.openanalysis.net opens in a new tab
research.openanalysis.net
securityintelligence.com opens in a new tab
securityintelligence.com
darkreading.com opens in a new tab
darkreading.com
elastic.co opens in a new tab
elastic.co
hivepro.com opens in a new tab
hivepro.com
intrinsec.com opens in a new tab
intrinsec.com
malware-traffic-analysis.net opens in a new tab
malware-traffic-analysis.net
malwarebytes.com opens in a new tab
malwarebytes.com
trendmicro.com opens in a new tab
trendmicro.com
virusbulletin.com opens in a new tab
virusbulletin.com
vmray.com opens in a new tab
vmray.com
youtube.com opens in a new tab
youtube.com
youtube.com opens in a new tab
youtube.com
zscaler.com opens in a new tab
zscaler.com
zscaler.com opens in a new tab
zscaler.com
zscaler.com opens in a new tab
zscaler.com

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.