Get a Loda This: LodaRAT meets new friends
Summary: Cisco Talos reports that LodaRAT, an AutoIt-written remote access tool attributed to the Kasablanka group, has been observed in new variants throughout 2022, with recent samples removing version numbers from C2 beacons in favor of the infected host's IP address and adding Windows 11 detection. Talos also found LodaRAT deployed alongside or dropped by RedLine, Neshta, and a previously undocumented VenomRAT variant called S500, whose source code leaked publicly on GitHub in May 2022.
What you should know: LodaRAT's source can be pulled from compiled binaries with a decompiler and its C2 traffic is unencrypted, so any actor who obtains a sample can rebuild it with custom infrastructure - which is why Talos is tracking multiple altered variants rather than one codebase.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026