Pikabot

Description

Pikabot is a loader and backdoor that has been active since early 2023. Its components include a downloader and installer, a loader, and a core backdoor, and it resists analysis through extensive encoding, encryption, and defense evasion, including anti-debugging and anti-VM measures inspired by the open source Al-Khaser project and steganography that conceals its payload. Infections frequently lead to the deployment of follow on tools such as Cobalt Strike or ransomware variants.

Stats

First seen: August 2023
Last seen: October 2026

Also known as

PikaBot

MITRE ATT&CK techniques

21 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.011Fileless Storage
- T1027.003Steganography
- T1027.009Embedded Payloads
T1055Process Injection
- T1055.003Thread Execution Hijacking
- T1055.002Portable Executable Injection
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
- T1480.001Environmental Keying
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1620Reflective Code Loading
T1622Debugger Evasion

TA0007 Discovery

T1016System Network Configuration Discovery
T1082System Information Discovery
T1087Account Discovery
- T1087.001Local Account
T1482Domain Trust Discovery

TA0011 Command and Control

T1132Data Encoding
- T1132.001Standard Encoding
T1571Non-Standard Port
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G1037TA577

Associated campaigns

Alert name variants

Alert Name	Engine
ByteCode-JAVA.Trojan.Pikabot	ATP Sandbox Adv. Heuristics
Document-HTML.Downloader.PikaBot	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.Pikabot	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.PikaBot	ATP Sandbox Adv. Heuristics
Document-Office.Downloader.PikaBot	ATP Sandbox Adv. Heuristics
Document-Office.Trojan.PikaBot	ATP Sandbox Adv. Heuristics
Document-PDF.Trojan.Pikabot	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.Pikabot	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.PikaBot	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Pikabot	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.PikaBot	ATP Sandbox Adv. Heuristics
Win32.Backdoor.PikaBot	ATP Sandbox Adv. Heuristics
Win32.Trojan.Pikabot	ATP Sandbox Adv. Heuristics
Win32.Trojan.PikaBot	ATP Sandbox Adv. Heuristics
Win64.Trojan.Pikabot	ATP Sandbox Adv. Heuristics

Related blogs

New Bumblebee Loader Infection Chain Signals Possible Resurgence

October 18, 20244 min read