Pikabot Malware: Delivery Methods, Evasion, and Impact

Introduction to Pikabot Malware:

First identified in 2023, Pikabot is a malware loader that gained prominence after being adopted by a BlackBasta ransomware affiliate following the Qakbot takedown. After a period of inactivity, it re-emerged in February 2024 with significant changes to its codebase, network communications, and obfuscation techniques. Pikabot functions as a backdoor, enabling attackers to execute commands, communicate with command-and-control (C2) servers, and deliver additional payloads to compromised systems.

Delivery Methods of Pikabot Malware:

Pikabot is primarily distributed through targeted phishing campaigns that rely on malicious email attachments and links. Common delivery methods include ZIP archives, Office documents, HTML attachments containing JavaScript, and links to malicious files hosted on external SMB shares. Recent campaigns have also exploited the Outlook MonikerLink vulnerability by embedding SMB links in emails, increasing the likelihood of user interaction and successful infection. Once executed, Pikabot leverages anti-analysis, anti-debugging, and anti-sandbox techniques to evade detection and maintain stealth.

Impact of Pikabot Malware:

Pikabot remains a significant threat due to its ability to establish persistent access to infected systems and serve as a delivery mechanism for additional malware, including tools such as Cobalt Strike. Its evolving evasion techniques, combined with diverse delivery methods and active 2024 campaigns, allow attackers to maintain footholds in compromised environments and increase the risk of follow-on attacks, including ransomware deployment and broader network compromise.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

Pikabot Malware TTPS

Pikabot Malware IOCs (Sample of 50)