Spike in Loki Bot Activity During Final Week of 2022
Summary: Unit 42 researchers identified a LokiBot information stealer campaign delivered through business email compromise phishing, using a ZIP attachment containing an ISO file that carried the final payload. The malware uses process hollowing to inject into aspnet_compiler.exe, API hashing for obfuscation, and a registry Run key for persistence, and ThreatFox data showed LokiBot activity peaking in the last three days of December 2022.
Key Takeaway: The peak landed in the final three days of December, when security and other personnel are off and attacks are more effective - and the ISO delivery is chosen specifically to slip past malspam detection tuned for EXE, DLL, and Office files.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026