Loading story…
Researchers reported a surge in LiteHTTP malware activity, identifying 106 samples first seen on VirusTotal during a short period in May 2018 and linking many of them to the same command-and-control infrastructure at topksa[.]net. Observed panel paths included hxxp://topksa[.]net/Panel/page[.]php and hxxp://topksa[.]net/Panel/login/, and the panel was still reachable at the time of reporting. Additional LiteHTTP panels, domains, IP addresses, and malware hashes were also tied to infrastructure active since at least April 2018.
Publicly available source material shows LiteHTTP was presented as an HTTP bot written in C# for .NET 2.0, with a web-based administration panel and features consistent with botnet operations. The advertised capabilities included download-and-execute, persistence, host information collection, webpage visits, updating, and uninstalling, as well as multi-user panel access, privilege controls, and action logging. Together, the reporting and code repository indicate an actively used malware family supported by accessible operator tooling and shared C2 infrastructure.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The GitHub repository for LiteHTTP shows its latest visible commit by zettabithf on October 28, 2018, indicating the malware tooling was maintained through at least that date.
The IOC post states that sightings of new LiteHTTP samples on VirusTotal stopped after May 20, 2018, ending the May spike described by the researcher.
The analysis reports that 106 LiteHTTP malware samples were first seen on VirusTotal between May 2 and May 20, 2018, marking a notable surge in sightings. Many of those samples reportedly communicated with the same topksa.net control panel.
The IOC-focused analysis states that other LiteHTTP command-and-control panels had been active since April 1, 2018. It lists multiple panel URLs, domains, IPs, and associated sample hashes tied to that infrastructure.
A commit message in the LiteHTTP GitHub repository states "Fixed Broken Encryption," indicating a code change to the malware tooling. The repository dates that commit to October 5, 2017.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 166 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented how **LokiBot** operators deploy and run their command-and-control infrastructure, showing that the malware’s PHP-based panels commonly expose a gate for receiving stolen data and an administrative interface for operators. Analysis of 1,960 real-world panel URLs found that about **95%** used the obfuscated entry point `PvqDq929BSx_A_D_M1n_a.php`, while many deployments relied on plain **HTTP** rather than HTTPS. Separate traffic analysis tooling also showed Loki-Bot exfiltrating credentials and application data over HTTP POST requests to C2 paths such as `ver.php`, reinforcing that the malware’s network activity can often be parsed and tracked in transit. A newer Loki sample also used a heavily obfuscated, multi-stage infection chain to hide delivery and execution. The attack began with an **HTA** file that concealed a PowerShell downloader through layered URL encoding, Base64, and character substitution; that downloader fetched a **VBS** script, which then retrieved an image from Google Drive containing a steganographically hidden, reversed Base64 payload. The decoded .NET assembly was injected into `aspnet_regbrowsers.exe`, after which the malware contacted C2 infrastructure and attempted to deploy additional payloads, highlighting recurring Loki tradecraft around phishing delivery, script-based loaders, steganography, and covert credential theft.
Aug 15, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026