Threat Intel
PIKABOT Loader Update: New Unpacking, Obfuscation, and Phishing Campaigns
Elastic Security Labs uncovered a new PIKABOT loader variant that uses scattered base64 chunks, inline RC4 decryption, and plaintext configuration to evade detection. The campaign delivers the loader via ZIP attachments in phishing emails and launches PowerShell to download the payload. Defenders should block ZIPs from unknown senders, monitor for suspicious PowerShell activity, and update detection rules for the new unpacking pattern.
What Happened
Elastic Security Labs detected a fresh PIKABOT campaign on February 8th featuring an updated loader that employs a new unpacking method and enhanced obfuscation. The distribution vector was a ZIP attachment in phishing emails that contained an obfuscated JavaScript payload which launches PowerShell to download the loader.
Impact
PIKABOT is a widely used loader that can deliver Cobalt Strike, ransomware, or other payloads. The new variant bypasses many existing signature‑based detections by using scattered base64 chunks, inline RC4 decryption, and plaintext configuration at runtime. It also removes AES encryption from network traffic, making traffic appear benign.
What to Do
- Block or quarantine ZIP attachments from unknown senders and monitor for outbound PowerShell requests to suspicious domains.
- Enable detection of obfuscated JavaScript and PowerShell execution in your EDR and SIEM.
- Update your loader‑detection rules to look for scattered base64 data and inline RC4 functions.
- Apply the latest Elastic Security signatures that flag the new PIKABOT unpacking pattern.
Technical Details
The loader fetches a .dat file, splits it into encrypted chunks, decrypts them with RC4, and writes an executable to %SYSTEMDRIVE%\Users\Public. The configuration is supplied in clear text during runtime, and the loader removes AES encryption from its network communications, reducing forensic visibility.
Related articles
BlueKit Phishing-as-a-Service Enables Rapid Account Hijacking
BlueKit, a turnkey phishing platform, lets attackers launch sophisticated account‑hijacking campaigns in minutes. The kit includes a command center, tracking, and a library of 97 brand templates. Defenders should block known BlueKit domains, monitor for phishing emails, and harden MFA on high‑risk accounts.
Read briefing
Singapore Delivery Scams: Three Fraudster Groups Exposed by Group‑IB
Group‑IB has identified three distinct fraudster collectives orchestrating delivery‑based scams targeting Singapore consumers and businesses. The groups exploit legitimate courier services to deliver counterfeit or tampered goods, often as part of larger phishing or ransomware campaigns. Defenders should monitor shipment logs, verify sender authenticity, and educate staff on red‑flag indicators.
Read briefing
Group‑IB Exposes China‑Linked Operation Using TriBack Loader
An exposed staging server revealed a China‑originated threat actor targeting government, healthcare, and education sectors in Vietnam, Malaysia, and Hong Kong, while phishing LATAM victims. Defenders should audit staging environments, block TriBack Loader, and strengthen authentication and segmentation.
Read briefing
FINALDRAFT Malware Uses Microsoft Graph API for C2 in Espionage Campaign
Elastic Security Labs uncovered a new espionage malware family, FINALDRAFT, that leverages Outlook and Microsoft Graph API for command and control. The kit includes a lightweight Windows loader, PATHLOADER, and a Linux variant, using typosquatted domains and API hashing to evade analysis. Defenders should block the identified domains, monitor Graph API traffic, and detect PATHLOADER execution.
Read briefing