Pikabot

Malware updated 25 days ago (2024-08-14T09:30:22.848Z)
Download STIX
Preview STIX
PikaBot is a malicious software (malware) known for providing initial access to infected computers, enabling ransomware deployments, remote takeovers, and data theft. It's part of an array of malware families such as IcedID, Qakbot, Gozi, DarkGate, AsyncRAT, JinxLoader, among others, which have been used in cyber attacks. PikaBot has been distributed by threat group TA577 and has also been linked to the BlackBasta Ransomware. The infection chain of PikaBot was initially delivered through phishing and vishing by Black Basta, who later sought alternatives for further malicious activities. In November 2023, TA577, previously known for its distribution of Qbot, used Latrodectus in three campaigns before switching back to PikaBot. Blackberry researchers identified an increased use of particular malware families, including PrivateLoader, RisePro, SmokeLoader, and PikaBot. The same malvertising technique has been used in connection with several initial access malware, including the PikaBot botnet agent, IcedID information stealer, and Gozi backdoor malware families. While Qakbot has returned in some limited form, it has been largely supplanted by its would-be successors, PikaBot and DarkGate. Between May 27th and 29th, 2024, an international law enforcement operation coordinated by Europol, codenamed Operation Endgame, targeted malware droppers like IcedID, SystemBC, PikaBot, Smokeloader, Bumblebee, and Trickbot. Despite these efforts, PikaBot continues to pose a significant threat due to its ability to bypass certain EDR (Endpoint Detection and Response) systems, highlighting the need for robust cybersecurity measures.
Description last updated: 2024-08-14T08:40:57.303Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
IcedID
4
IcedID is a malicious software (malware) that has been linked to various cybercrime operations. The malware can infiltrate systems via suspicious downloads, emails, or websites and proceed to steal personal information, disrupt operations, or hold data for ransom. IcedID has been associated with oth
TA577
4
TA577 is a threat actor, or malicious entity, known for its extensive use of QBot, a banking Trojan. In November 2023, Proofpoint's Threat Research Team identified TA577 as an initial access broker that began using Latrodectus, a new malware, in three separate intrusion campaigns. The group typicall
Smokeloader
2
Smokeloader is a malicious software (malware) that has been utilized by threat actors, specifically Phobos actors, to embed ransomware as a hidden payload. This malware, acting as a loader for other malware, infects systems through suspicious downloads, emails, or websites, often without the victim'
Gozi
2
Gozi is a notorious malware that has been linked to numerous cyber attacks. It's typically delivered through sophisticated malvertising techniques, often used in conjunction with other initial access malware such as Pikabot botnet agent and IcedID information stealer. When an individual accesses a c
Blackbasta
2
BlackBasta is a notorious malware, specifically ransomware, that has been associated with several high-profile cyber-attacks. This malicious software infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal information,
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Loader
Payload
Ransomware
Trojan
Phishing
Malvertising
Spam
Botnet
Evasive
Exploit
Dropper
Windows
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
IDTypeVotesProfile Description
QakBotUnspecified
9
Qakbot is a type of malware that has been linked to various cybercriminal activities, with its presence first observed as early as 2020. It gained notoriety for its role in the operations of the Black Basta ransomware group, which used Qakbot extensively in sophisticated phishing campaigns. The malw
DarkgateUnspecified
5
DarkGate is a malicious software (malware) designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. Once embedded in a system, DarkGate can steal personal information, disrupt operations, or hold data for ransom. Recently, the malware was
Black BastaUnspecified
3
Black Basta is a notorious malware group known for its ransomware activities. The group has been active since at least early 2022, during which time it has accumulated an estimated $107 million in Bitcoin ransom payments. It leverages malicious software to infiltrate and exploit computer systems, of
QbotUnspecified
3
Qbot, also known as Qakbot or Pinkslipbot, is a modular information-stealing malware that emerged in 2007 as a banking trojan. Over the years, it has evolved into an advanced malware strain used by multiple cybercriminal groups to compromise networks and prepare them for ransomware attacks. The firs
SystembcUnspecified
2
SystemBC is a type of malware, or malicious software, that has been heavily utilized in cyber-attacks and data breaches. Throughout 2023, it was frequently used in conjunction with other malware like Quicksand and BlackBasta by cybercriminals to exploit vulnerabilities in computer systems. Play rans
BumblebeeUnspecified
2
Bumblebee is a type of malware that has been linked to ITG23, a cybercriminal group known for its use of crypters such as Emotet, IcedID, Qakbot, Bumblebee, and Gozi. Distributed via phishing campaigns or compromised websites, Bumblebee enables the delivery and execution of further payloads. The sam
Source Document References
Information about the Pikabot Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
DARKReading
a month ago
Black Basta Develops Custom Malware in Wake of Qakbot Takedown
BankInfoSecurity
3 months ago
Researchers Uncover Chinese Hacking Cyberespionage Campaign
Securityaffairs
3 months ago
Operation Endgame, the largest law enforcement operation ever against botnets
BankInfoSecurity
5 months ago
Sophisticated Latrodectus Malware Linked to 2017 Strain
CERT-EU
6 months ago
Threat actors are turning to novel malware as malicious attacks rise
CERT-EU
6 months ago
Cybercrime on Main Street – Sophos News | #cybercrime | #infosec | National Cyber Security Consulting
CERT-EU
6 months ago
Cybercrime on Main Street – Sophos News | #cybercrime | #computerhacker - Am I Hacker Proof
CERT-EU
6 months ago
How new and old security threats keep persisting - Help Net Security
CERT-EU
6 months ago
How new and old security threats keep persisting - Help Net Security
CERT-EU
6 months ago
Kaspersky spam and phishing report for 2023
CERT-EU
6 months ago
Hackers steal Windows NTLM authentication hashes in phishing attacks
CERT-EU
6 months ago
Week in review: LockBit leak site is back online, NIST updates its Cybersecurity Framework - Help Net Security
CERT-EU
6 months ago
Week in review: LockBit leak site is back online, NIST updates its Cybersecurity Framework | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware | National Cyber Security Consulting
Malwarebytes
6 months ago
PikaBot malware on the rise: What organizations need to know  | Malwarebytes
CERT-EU
6 months ago
Pikabot returns with new tricks up its sleeve - Help Net Security
CERT-EU
6 months ago
Pikabot returns with new tricks up its sleeve - Help Net Security
CERT-EU
7 months ago
Secure email gateways struggle to keep pace with sophisticated phishing campaigns - Help Net Security
CERT-EU
7 months ago
O365 Volume Up in Q4 as Cybercriminals Target Brands in Credential Theft Attacks
Malwarebytes
7 months ago
Ransomware review: January 2024
Flashpoint
7 months ago
The Emerging Threat of PikaBot Malware