LODEINFO
LODEINFO is a sophisticated fileless backdoor and espionage malware family tracked since 2019 and first publicly named by JPCERT/CC in February 2020. It is strongly associated with the China-aligned threat actor MirrorFace, also tracked as Earth Kasha and often linked to APT10, and is described as malware unique to that group and as its primary backdoor since 2019. Reporting states it has primarily targeted Japanese organizations, including media, diplomatic, governmental, public sector, think tanks, political entities, academic institutes, and defense-related organizations; later Earth Kasha activity expanded targeting to Japan, Taiwan, and India, especially government and advanced technology sectors.
Observed infection vectors include spearphishing with Japanese-language Microsoft Word decoys and malicious VBA macros, self-extracting RAR archives, DLL sideloading using legitimate signed executables such as K7SysMon.exe/NRTOLF.exe with malicious K7SysMn1.dll, and exploitation of public-facing applications including FortiOS/FortiProxy, Array AG, and Proself in later campaigns. Kaspersky also documented a multi-stage downloader shellcode named DOWNIISSA that downloaded XOR-encrypted payloads from URLs including http://172.104.112[.]218/11554.htm and http://www.dvdsesso[.]com/11554.htm, then injected LODEINFO v0.6.5 into msiexec.exe. Additional related payload files observed on the same infrastructure included 3390.htm, 5246.htm, and 16412.htm.
LODEINFO supports backdoor command execution, shellcode and DLL in-memory execution, process injection, and network discovery. Reported capabilities include running net view and net view /domain for discovery, collecting stolen web cookies locally in the %TEMP% folder, beaconing host metadata such as current time, ANSI code page identifier, MAC address, and hostname, and injecting second-stage shellcode. Kaspersky documented use of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread for 32-bit injection, and NtAllocateVirtualMemory, NtWriteVirtualMemory, and RtlCreateUserThread for 64-bit injection. Versions v0.5.6 and later added commands including comc, autorun, and config; v0.6.3 reduced the command set to 11 retained commands: command, send, recv, memory, kill, cd, ver, print, ransom, comc, and config.
The malware’s C2 protocol evolved significantly across versions. Reported versions include v0.4.7, v0.5.8, v0.5.9, v0.6.2, v0.6.3, v0.6.5, and later v0.6.6 and v0.6.7. Kaspersky described a layered encryption and encoding chain using SHA512, XOR, AES-CBC, Base64 with modified padding, and a Vigenere cipher; beacon traffic used the hardcoded key "NV4HDOeOVyL" and sometimes appended random junk data to hinder beacon-size detection. Later versions generated Chrome-like Windows 10 x64 user-agent strings, attempting to read the installed Chrome version and falling back to 98.0.4758.102 if unavailable. Anti-analysis and evasion features include obfuscated command identifiers, custom API hashing changes intended to complicate reverse engineering, and a locale check in v0.6.2 and later that halts execution on en_US systems, assessed as anti-sandbox/anti-research behavior.
LODEINFO has been updated frequently, with JPCERT/CC noting that since version 0.4.x its launch method shifted to LOLBAS techniques. Kaspersky assessed the operators continuously evolve both implants and delivery methods to evade security products and hinder analysis. In one 2023 intrusion at a Japanese research institute, attackers exploited a FortiOS/FortiProxy vulnerability, deployed LODEINFO, and then deployed HiddenFace/NOOPDOOR, indicating LODEINFO can also serve as an earlier-stage backdoor in broader MirrorFace operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MirrorFace overview ... LODEINFO malware unique for the group ... August 2023 ... LODEINFO deployed → MirrorFace HiddenFace deployed.
Kaspersky has been tracking activities involving the LODEINFO malware family since 2019... LODEINFO is sophisticated fileless malware first named in a blogpost from JPCERT/CC in February 2020.
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueMirrorFace has created and continued to develop custom strains of malware including LODEINFO.
Initial Access
2 techniquesAugust 2023 ... Japanese research institute ... Exploited a vulnerability in FortiOS/FortiProxy → NOT via spearphishing
During our investigation of the attacks in March 2022, we observed a spear-phishing email with a malicious attachment installing malware persistence modules...
Execution
4 techniquesOnce opened, the doc file shows a Japanese message to enable the following VBA code... the malicious macro code injects and loads an embedded shellcode in the memory of the WINWORD.exe process directly.
The embedded VBA code creates the folder C:\Users\Public\TMWJPA\ and drops a zip file named GFIUFR.zip...
Persistence
1 techniqueThe content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or batch files in the Windows Startup folder.
Privilege Escalation
2 techniquesDuring the memory injection process... the malware checks the first byte of the second stage shellcode to determine the shellcode architecture... it uses the basic Windows APIs such as VirtualAllocEx(), WriteProcessMemory() and CreateRemoteThread() for memory injection of the 32-bit shellcode and NtAllocateVirtualMemory(), NtWriteVirtualMemory() and RtlCreateUserThread() for supporting the memory injection of the 64-bit shellcode.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or batch files in the Windows Startup folder.
Stealth
8 techniquesThis LODEINFO v0.5.6 shellcode extracted from a loader module demonstrates several enhanced evasion techniques... The beacon also contains a hardcoded key... randomly generated junk data is appended to the end of the data, possibly to evade beaconing detection based on packet size.
The attackers exploited the name of a well-known Japanese politician... The file name and the decoy document suggest the target was the Japanese ruling party or a related organization.
During the memory injection process... the malware checks the first byte of the second stage shellcode to determine the shellcode architecture... it uses the basic Windows APIs such as VirtualAllocEx(), WriteProcessMemory() and CreateRemoteThread() for memory injection of the 32-bit shellcode and NtAllocateVirtualMemory(), NtWriteVirtualMemory() and RtlCreateUserThread() for supporting the memory injection of the 64-bit shellcode.
For the final stage of the infection, DOWNIISSA creates an instance of msiexec.exe and injects the LODEINFO backdoor shellcode in the memory of the process.
In LODEINFO v0.6.2 and later versions, the shellcode has a new feature that looks for the “en_US” locale on the victim’s machine in a recursive function and halts execution if that locale is found.
The malware checks the OS architecture of the infected machine and handles the appropriate loading scheme according to OS architecture and shellcode architecture.
Credential Access
1 techniqueDiscovery
6 techniquesDuring the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.
After infecting the target machine, the LODEINFO backdoor beacons out machine information to the C2, such as current time, ANSI code page (ACP) identifier, MAC address and hostname.
Lateral Movement
1 techniqueCollection
3 techniqueskeylog Check for Japanese keyboard layout. Save keystrokes, datetime and active window name. Uses 1-byte XOR encryption and a file %temp%\%hostname%.tmp.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Command and Control
2 techniquesLODEINFO v0.6.2: generating user agent for C2 communications... The malware generates the user agent string using the following hardcoded formatted string... Mozilla/5.0 ... Chrome/%s Safari/537.36.
Exfiltration
1 techniqueImpact
1 techniqueransom Encrypt files by a generated AES key, which is also encrypted with RSA using the hardcoded RSA key.
IOCs tracked for this family
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware developed and used by MirrorFace.
LODEINFO is a custom backdoor used primarily by the Earth Kasha threat group, supporting a wide range of commands for file operations, credential theft, keylogging, and in-memory execution of DLLs or shellcode. It is deployed via DLL side-loading and uses encrypted payloads embedded in digital signatures, exploiting CVE-2013-3900. LODEINFO has evolved through multiple versions, with new commands and features added over time.
Sophisticated fileless backdoor attributed to APT10; newer versions added obfuscated command identifiers and Vigenere cipher usage to hinder analysis and evade detection.
Backdoor used in targeted attacks; updated frequently and (since v0.4.x) launched via LOLBAS techniques.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.