Lobshot

Lobshot is a stealthy remote access malware that has been used by cybercriminals, notably Russian threat actors, in various malicious campaigns. It was featured alongside other well-known malware samples like DarkGate infostealer, Ducktail, and Redline in deceptive campaigns where it was embedded into fake Windows 11 upgrade installers. The malware is known to be distributed through malvertising techniques, with threat groups leveraging these strategies to disguise legitimate software with backdoors such as Lobshot. The campaigns involving Lobshot have shown a high level of sophistication, suggesting the possible involvement of a single actor or group across multiple operations. For instance, Lobshot, along with DarkGate, Ducktail, and Redline Stealer, was deployed by a Vietnam-based cybercrime group targeting English-language Facebook business accounts in a campaign aimed at digital marketing firms in the U.S., UK, and India. This group used these malware types in conjunction with Malware as a Service (MaaS) toolkits to infect victims with Remote Access Trojans (RATs) and additional info-stealing malware. In addition to its use in broad campaigns, Lobshot's stealth and remote access capabilities make it a significant threat to individual users and businesses alike. Its association with other malware types such as Ducktail, which is used to steal Facebook business accounts, and Redline, which collects information about infected devices, underscores the multifaceted nature of the threats posed by these coordinated cybercrime efforts. As such, heightened vigilance and robust cybersecurity measures are necessary to mitigate the risks associated with Lobshot and similar malware.