Understanding PikaBot: The Rising Cyber Threat

04.03.24

Threat Intelligence Alerts

PikaBot is a type of malware that has been gaining notoriety since its emergence in early 2023¹²⁴. It is a modular trojan, a successor to the infamous QakBot (QBot) trojan, which was widely used by ransomware gangs for its versatile ability to facilitate initial access and deliver secondary payloads¹. With the shutdown of QBot, PikaBot has stepped in to fill the void, becoming a tool of choice for cybercriminals¹.

PikaBot operates by executing arbitrary commands, downloading additional payloads, and injecting malicious shellcodes into legitimate processes running on a victim’s computer¹². This makes it a potent backdoor for attackers to set up for the next stages of their attacks¹.

The distribution of PikaBot is primarily through email spam campaigns¹. These campaigns are meticulously crafted, utilising geolocalised spam emails that target specific countries¹. The emails often contain links to external SMB (Server Message Block) shares, which host malicious zip files¹. Once a user interacts with these emails by clicking on the link, they are taken to the SMB share hosting the malicious zip files, resulting in a PikaBot infection¹.

Organisations can take several steps to protect themselves from PikaBot:

PikaBot is not just a standalone threat but also a facilitator for other cyber threats. It has been observed being used to distribute other malicious tools such as Cobalt Strike². Its modular nature, combined with its stealthy distribution methods, makes it a formidable threat to organisations. As PikaBot continues to evolve and gain prevalence, organisations must stay informed and take appropriate measures to protect their systems and data.

In conclusion, the rise of PikaBot represents a significant development in the cyber threat landscape. Its modular nature, combined with its stealthy distribution methods, makes it a formidable threat to organisations. As PikaBot continues to evolve and gain prevalence, organisations must stay informed and take appropriate measures to protect their systems and data.

1. PikaBot malware on the rise: What organizations need to know

2. Pikabot | ThreatLabz – Zscaler

3. The Emerging Threat of PikaBot Malware | Flashpoint

4. PikaBot malware: Unveiling the malicious network

5. PikaBot – A New Emerging Threat – Obrela

6. PikaBot distributed via malicious search ads | Malwarebytes

7. Deep dive into the Pikabot cyber threat – Sophos News

8. A Deep Dive Into Pikabot: An Emerging Cyber Threat in 2023

9. https://github.com/CheckPointSW/Evasions/blob/master/_techniques/processes.md