Malware

AxolotlLoader

Tracked since Oct 14, 2026 · Updated 11 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 1 in a dayToday

Vulns0Associated

Actors0Associated

ATT&CK8Techniques

IOCs42Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

"The scheduled task uses /sc minute /mo 60 and runs immediately."

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

"The scheduled task uses /sc minute /mo 60 and runs immediately."

T1547.001Registry Run Keys / Startup FolderEvidence1

"Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence."

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

"The scheduled task uses /sc minute /mo 60 and runs immediately."

T1547.001Registry Run Keys / Startup FolderEvidence1

"Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence."

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Lorem Ipsum uses "word-based shellcode encoding," while Axolotl's decrypted shellcode uses "a distinct stack-junk obfuscator."

T1027.009Embedded PayloadsEvidence1

Axolotl's ciphertext "is appended after the PNG IEND chunk inside a named PNG resource." Lorem Ipsum carries malicious content in an added ".cpoc section."

T1036MasqueradingEvidence1

The detection table identifies signed copies of "OLEVIEW.EXE, ieinstall.exe, Task Explorer, PE Detective and WebLaunchAssistant.exe."

T1140Deobfuscate/Decode Files or InformationEvidence1

Lorem Ipsum's decoded blob "jumps over an embedded decoy JPEG and XORs the remaining content in 8-byte units."

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

"All 39" analyzed Axolotl samples share a certificate with subject "BUSINESS CONSULTING SP Z O O."

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The loader sends "a POST request to /api/init/ with Content-Type: image/jpeg and an embedded decoy JPEG as the body" and then polls every five seconds.

Indicators of compromise

Observables

42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyber security newsNews · Oct 15, 2026Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware AttacksLoader examined through 39 samples spanning three variants and multiple legitimate host programs. It uses embedded PNG data to decode shellcode. Its registration patterns and hosting infrastructure overlap with Lorem Ipsum Loader, but its implementation differs. Researchers considered an evolutionary relationship likely without confirming it. The variants are identified as A1, A2, and B.Read more ↗forescoutNews · Oct 14, 2026From ClickFix to C2: Comparative Analysis of Two Malware Loaders - ForescoutStandalone executable loader that decrypts shellcode using an embedded PNG image as an XOR key, with ciphertext stored after the PNG IEND chunk. Its shellcode employs stack-junk obfuscation before allocating executable memory and running an inner payload. The analysis identifies three variants, A1, A2, and B, distinguished by host programs and execution redirection mechanisms. All 39 analyzed samples share a BUSINESS CONSULTING SP Z O O signing certificate. Unlike Lorem Ipsum, Axolotl uses hardcoded C2 addresses and UUIDs, communicates through WinINet, and lacks the observed process-injection and ntdll-unhooking features. Similar C2 registration behavior and hosting infrastructure suggest a connection to Lorem Ipsum without establishing that they are the same family.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching42Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Malware

AxolotlLoader

Tracked since Oct 14, 2026 · Updated 11 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 1 in a dayToday

Vulns0Associated

Actors0Associated

ATT&CK8Techniques

IOCs42Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

"The scheduled task uses /sc minute /mo 60 and runs immediately."

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

"The scheduled task uses /sc minute /mo 60 and runs immediately."

T1547.001Registry Run Keys / Startup FolderEvidence1

"Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence."

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

"The scheduled task uses /sc minute /mo 60 and runs immediately."

T1547.001Registry Run Keys / Startup FolderEvidence1

"Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence."

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Lorem Ipsum uses "word-based shellcode encoding," while Axolotl's decrypted shellcode uses "a distinct stack-junk obfuscator."

T1027.009Embedded PayloadsEvidence1

Axolotl's ciphertext "is appended after the PNG IEND chunk inside a named PNG resource." Lorem Ipsum carries malicious content in an added ".cpoc section."

T1036MasqueradingEvidence1

The detection table identifies signed copies of "OLEVIEW.EXE, ieinstall.exe, Task Explorer, PE Detective and WebLaunchAssistant.exe."

T1140Deobfuscate/Decode Files or InformationEvidence1

Lorem Ipsum's decoded blob "jumps over an embedded decoy JPEG and XORs the remaining content in 8-byte units."

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

"All 39" analyzed Axolotl samples share a certificate with subject "BUSINESS CONSULTING SP Z O O."

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The loader sends "a POST request to /api/init/ with Content-Type: image/jpeg and an embedded decoy JPEG as the body" and then polls every five seconds.

Indicators of compromise

Observables

42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

Start Free Trial Open in App ↗

IOC matching42Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.