Loading story…
Recent crimeware activity shows DarkGate, Emotet, and LokiBot continuing to rely on layered infection chains, phishing lures, and in-memory execution to evade detection and deliver malware. DarkGate has been distributed through a multi-stage sequence involving a VBS downloader, AutoIT components, shellcode, and a final loader that decrypts and runs its payload in memory. Emotet has likewise remained active after its earlier disruption, using malicious OneNote attachments and VBScript downloaders to retrieve a DLL that decrypts shellcode and launches the final payload while attempting to avoid analysis.
LokiBot activity has also persisted through phishing campaigns, including operations targeting cargo shipping companies with fake macro-themed lures and exploits for CVE-2017-0199 and CVE-2017-11882 to install the infostealer. U.S. government reporting has previously linked LokiBot to sustained credential theft, keylogging, password store extraction, process hollowing, HTTP-based command-and-control, and occasional backdoor functionality for follow-on payloads, underscoring that older Office vulnerabilities and social-engineering delivery remain effective for commodity malware operators.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
A well-known malware developer advertised DarkGate in June 2023 on a popular dark web forum. The listing promoted capabilities including Hidden VNC, Windows Defender exclusion, reverse proxy, file management, and credential-related theft features.
The references state that Emotet was taken down in 2021 before later resurfacing. This establishes the disruption point preceding the malware's renewed activity.
CISA, with contributions from MS-ISAC, released advisory AA20-266A covering LokiBot activity, behaviors, ATT&CK mappings, and detection guidance including a Snort signature. The alert documented the malware's credential theft, keylogging, backdoor, and HTTP C2 capabilities.
CISA reported a notable increase in LokiBot use by malicious cyber actors since July 2020. The agency also said its EINSTEIN intrusion detection system saw persistent LokiBot activity on U.S. federal civilian executive branch networks.
CISA cited Trend Micro reporting from February 2018 that attackers exploited CVE-2017-11882 to deliver LokiBot using the Windows Installer service. Kaspersky also described a later LokiBot chain using CVE-2017-11882.
The DarkGate developer claimed the loader project had been under development since 2017, with more than 20,000 hours invested. This marks the earliest stated origin point for DarkGate in the references.
Kaspersky described LokiBot as an infostealer that first surfaced in 2016 and remains active. CISA also cited reporting from February 2016 on LokiBot Android trojan activity.
Microsoft published CVE-2017-0199 for a Microsoft Office/WordPad remote code execution vulnerability. Kaspersky later described LokiBot campaigns exploiting this flaw in their delivery chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcecisa.gov
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security reports documented **LokiBot/Loki Info Stealer** campaigns delivered through phishing emails that used a wide range of attachment types and exploit chains, including **LZH**, **ACE**, **RAR**, **PDF**, **DOCX**, **RTF**, and Excel-based lures. The messages commonly impersonated business documents such as payment confirmations, invoices, shipment notices, and purchase orders, while some samples abused PDF `OpenAction`, embedded URI actions, malicious macros, or exploits including **`CVE-2016-0189`**, **`CVE-2017-11882`**, **`CVE-2021-40444`**, and **`CVE-2022-30190`** to download or launch the malware. Researchers also observed compromised infrastructure hosting downloaders and payloads, along with HTTP POST traffic to attacker-controlled command-and-control endpoints. Once executed, LokiBot used layered evasion and execution techniques such as **process hollowing**, shellcode loaders, API hashing, anti-debugging, anti-VM checks, obfuscation, and in-memory decryption to avoid detection. The malware established persistence in user profile and startup locations, hid files under `%APPDATA%`, and stole credentials and data from browsers, FTP clients, email applications, password managers, Windows credentials, Microsoft Outlook registry entries, and even user files such as Stickies notes. Stolen information was compressed and exfiltrated over HTTP, and some variants also supported follow-on commands including downloading additional files, loading DLLs, updating themselves, and self-deleting, underscoring LokiBot’s continued use as a flexible credential-theft platform.
Aug 15, 2026
A recent phishing campaign is delivering **LokiBot** through malicious email attachments containing obfuscated JScript, reviving the long-running infostealer with a multi-stage infection chain designed to evade detection. The script runs via Windows Script Host, decodes a PowerShell loader, and decrypts a ConfuserEx-protected .NET injector that reflectively loads into memory before injecting the final payload into `aspnet_compiler.exe` using Windows APIs including `CreateProcessA`, `VirtualAllocEx`, `WriteProcessMemory`, `SetThreadContext`, and `ResumeThread`. Once executed, the 32-bit LokiBot payload uses API hashing and runtime API resolution, creates a mutex derived from the victim system's `MachineGuid`, steals credentials from numerous applications, compresses the data with **aPLib**, and beacons to HTTP command-and-control servers roughly every minute. Researchers said the malware stores C2 addresses with **3DES** encryption and noted a flawed persistence mechanism in some newer builder-generated samples, where a patched decryption routine causes the malware to use a C2 URL instead of the intended Run registry path; reported infrastructure includes the IP address `158.94.211.95`, and defenders were urged to block script-based attachments and watch for abnormal `aspnet_compiler.exe` activity.
Jun 29, 2026
**Emotet** re-emerged after the 2021 law-enforcement disruption and rebuilt its botnet through large-scale phishing and thread-hijacking campaigns that delivered malicious Office files, password-protected ZIPs, LNK files, and later OneNote lures. Across these waves, victims were tricked into enabling macros or opening shortcut-based droppers that launched obfuscated PowerShell, `mshta.exe`, JavaScript, or Excel 4.0/XLM macros to fetch Emotet DLLs from rotating lists of compromised websites, often executing them through `regsvr32.exe` or `rundll32.exe`. Researchers reported campaigns targeting millions of email addresses, with notable concentration in Japan and Italy, and observed operators adapting quickly as Microsoft blocked Internet-sourced VBA macros by default. The revived malware also introduced significant technical changes while preserving its role as an information stealer and malware delivery platform. Analysts documented a shift to 64-bit modules, stronger runtime obfuscation, updated loaders, and a move from older RSA-based protections to elliptic-curve cryptography with encrypted HTTP command-and-control traffic. Emotet continued harvesting host data, credentials, Outlook and Thunderbird email content, and Chrome-stored payment information, while restoring modules such as its SMB spreader to move laterally and using infected systems as spam bots. Multiple reports also linked Emotet to follow-on payload delivery including **IcedID**, **QakBot**, **Cobalt Strike**, **SystemBC**, **XMRig**, and ransomware-enabling access, underscoring its renewed position as a resilient initial-access and malware-as-a-service threat.
Aug 15, 2026