Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

Reviewed campaign intelligence

Pikabot Distribution February 2024

Historical · OTHER · Global

Last reviewed:

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Pikabot was distributed in Pikabot Distribution February 2024 using malicious emails with embedded links leading to malicious ZIP archives requiring user interaction for follow-on infection. The version of Pikabot distributed featured significant changes over the 2023 variant, including reduced code complexity and simplified obfuscation mechanisms.(Citation: Elastic Pikabot 2024)(Citation: Zscaler Pikabot 2024)

This is a historical record and does not establish current campaign activity.

Threat actor
Not established
Attribution confidence
Not established
First documented activity
2024-02-01
End date
Not established
Estimated victims
Not established
Reported impact
Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

  1. Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

  2. Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

MITRE ATT&CK techniques

  • T1574 · Hijack Execution Flow

    Stealth, Execution — Pikabot Distribution February 2024 utilized a tampered legitimate executable, `grepWinNP3.exe`, for its first stage Pikabot loader, modifying the open-source tool to execute malicious code when launched.(Citation: Elastic Pikabot 2024)

  • T1059.007 · JavaScript

    Execution — Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download.(Citation: Elastic Pikabot 2024)

  • T1059.001 · PowerShell

    Execution — Pikabot Distribution February 2024 passed execution from obfuscated JavaScript files to PowerShell scripts to download and install Pikabot.(Citation: Elastic Pikabot 2024)

  • T1566.002 · Spearphishing Link

    Initial Access — Pikabot Distribution February 2024 utilized emails with hyperlinks leading to malicious ZIP archive files containing scripts to download and install Pikabot.(Citation: Elastic Pikabot 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

  • MITRE ATT&CK C0036

    Official MITRE ATT&CK campaign record C0036. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.