Loading story…
Researchers identified a previously unknown backdoor called Loki that was used in targeted intrusions against more than a dozen Russian companies. The malware appears to be a private agent compatible with the Mythic C2 framework and derived from a Havoc agent, with delivery likely occurring through socially engineered email attachments and archive files bearing Russian-language filenames. Investigators said Loki functions as a loader-and-DLL malware chain: the loader collects host profiling data, encrypts it, and sends it to command-and-control infrastructure, which then returns an in-memory DLL payload responsible for executing attacker commands.
The malware includes multiple anti-analysis and evasion features inherited from Havoc, including encrypted memory, indirect API calls, and hashed API resolution, while also using a modified djb2 hash seed. Researchers also found several loader variants, active C2 infrastructure, and the use of public tunneling tools such as ngrok and a memory-loaded gTunnel component to reach private network segments. Attribution remains unresolved because the operators relied heavily on public tooling and individualized targeting rather than uniquely identifiable tradecraft.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers discovered a previously unknown backdoor named Loki in July 2024 and identified it as a private Mythic-compatible variant derived from a Havoc agent.
Researchers documented Loki's loader-plus-DLL architecture, encrypted host profiling, in-memory payload delivery, anti-analysis features inherited from Havoc, multiple loader variants, active C2 infrastructure, and use of tools including ngrok and gTunnel.
The Loki malware was used in targeted attacks against more than a dozen Russian companies, likely delivered through socially engineered email attachments and archives with Russian-language filenames.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented how **LokiBot** operators deploy and run their command-and-control infrastructure, showing that the malware’s PHP-based panels commonly expose a gate for receiving stolen data and an administrative interface for operators. Analysis of 1,960 real-world panel URLs found that about **95%** used the obfuscated entry point `PvqDq929BSx_A_D_M1n_a.php`, while many deployments relied on plain **HTTP** rather than HTTPS. Separate traffic analysis tooling also showed Loki-Bot exfiltrating credentials and application data over HTTP POST requests to C2 paths such as `ver.php`, reinforcing that the malware’s network activity can often be parsed and tracked in transit. A newer Loki sample also used a heavily obfuscated, multi-stage infection chain to hide delivery and execution. The attack began with an **HTA** file that concealed a PowerShell downloader through layered URL encoding, Base64, and character substitution; that downloader fetched a **VBS** script, which then retrieved an image from Google Drive containing a steganographically hidden, reversed Base64 payload. The decoded .NET assembly was injected into `aspnet_regbrowsers.exe`, after which the malware contacted C2 infrastructure and attempted to deploy additional payloads, highlighting recurring Loki tradecraft around phishing delivery, script-based loaders, steganography, and covert credential theft.
Aug 15, 2026
A recent phishing campaign is delivering **LokiBot** through malicious email attachments containing obfuscated JScript, reviving the long-running infostealer with a multi-stage infection chain designed to evade detection. The script runs via Windows Script Host, decodes a PowerShell loader, and decrypts a ConfuserEx-protected .NET injector that reflectively loads into memory before injecting the final payload into `aspnet_compiler.exe` using Windows APIs including `CreateProcessA`, `VirtualAllocEx`, `WriteProcessMemory`, `SetThreadContext`, and `ResumeThread`. Once executed, the 32-bit LokiBot payload uses API hashing and runtime API resolution, creates a mutex derived from the victim system's `MachineGuid`, steals credentials from numerous applications, compresses the data with **aPLib**, and beacons to HTTP command-and-control servers roughly every minute. Researchers said the malware stores C2 addresses with **3DES** encryption and noted a flawed persistence mechanism in some newer builder-generated samples, where a patched decryption routine causes the malware to use a C2 URL instead of the intended Run registry path; reported infrastructure includes the IP address `158.94.211.95`, and defenders were urged to block script-based attachments and watch for abnormal `aspnet_compiler.exe` activity.
Jun 29, 2026
Multiple security reports documented **LokiBot/Loki Info Stealer** campaigns delivered through phishing emails that used a wide range of attachment types and exploit chains, including **LZH**, **ACE**, **RAR**, **PDF**, **DOCX**, **RTF**, and Excel-based lures. The messages commonly impersonated business documents such as payment confirmations, invoices, shipment notices, and purchase orders, while some samples abused PDF `OpenAction`, embedded URI actions, malicious macros, or exploits including **`CVE-2016-0189`**, **`CVE-2017-11882`**, **`CVE-2021-40444`**, and **`CVE-2022-30190`** to download or launch the malware. Researchers also observed compromised infrastructure hosting downloaders and payloads, along with HTTP POST traffic to attacker-controlled command-and-control endpoints. Once executed, LokiBot used layered evasion and execution techniques such as **process hollowing**, shellcode loaders, API hashing, anti-debugging, anti-VM checks, obfuscation, and in-memory decryption to avoid detection. The malware established persistence in user profile and startup locations, hid files under `%APPDATA%`, and stole credentials and data from browsers, FTP clients, email applications, password managers, Windows credentials, Microsoft Outlook registry entries, and even user files such as Stickies notes. Stolen information was compressed and exfiltrated over HTTP, and some variants also supported follow-on commands including downloading additional files, loading DLLs, updating themselves, and self-deleting, underscoring LokiBot’s continued use as a flexible credential-theft platform.
Aug 15, 2026