Pikabot malware

Pikabot was a malware loader first seen in February 2023. Initial access brokers used it to establish a foothold in corporate networks and download whatever came next, most often post-exploitation frameworks such as Cobalt Strike and Meterpreter. Successful Pikabot compromises were repeatedly reported as leading to Black Basta ransomware deployment. Pikabot filled the gap left by Qakbot after law enforcement dismantled that botnet in August 2023. One of Qakbot's largest distributors adopted Pikabot from September 2023 and drove it into large-scale phishing campaigns. Pikabot's code was not derived from Qakbot. The relationship was commercial and operational, not a direct technical lineage. Pikabot is no longer active. Between 27 and 29 May 2024, Operation Endgame disrupted the infrastructure behind several major loaders, including Pikabot. The Sekoia Threat Detection & Research (TDR) team supported French law enforcement with cyber threat intelligence on Pikabot as part of that operation. Unlike some other families targeted at the same time, Pikabot did not return. Pikabot is a useful case study in how a loader can rise quickly after a major takedown and then disappear when its infrastructure and concentrated user base are removed.

Key takeaways

Pikabot was a loader, not a backdoor. Its role was to establish access and fetch a second-stage payload.
It filled the gap left by Qakbot. A major Qakbot distributor adopted Pikabot after the August 2023 takedown.
It invested heavily in analysis evasion. Environment checks, debugger detection, junk code, encrypted staging, and direct system calls made analysis harder.
Operation Endgame ended it. The international operation disrupted Pikabot's infrastructure in May 2024, and the malware did not resume afterward.
A concentrated customer base made it fragile. Sekoia assessed that one distributor was Pikabot's primary and possibly exclusive user, which may explain why the service did not rebuild after the takedown.

What Pikabot did

Pikabot was built as a multi-stage loader. Each stage unpacked and launched the next, with the final component fingerprinting the machine, reporting to command-and-control infrastructure, and waiting for instructions.

Its instruction set matched its role. It could run a command, download and inject code into another process, enumerate running processes, update itself, or shut down. The final theft, surveillance, or encryption came from the payload that followed it.

That distinction matters when triaging a detection. Pikabot was the delivery mechanism for what the operator intended to install or sell. A Pikabot alert therefore indicated that an intrusion was already underway and that another payload had probably followed.

How Pikabot evaded analysis

A significant share of Pikabot's development focused on making the loader difficult to inspect and detect:

Environment checks: It looked for signs that it was running in a sandbox or analysis environment and could stop when those conditions were detected.
Debugger detection: It checked for debugging tools and behavior associated with analysis.
Junk code: It added meaningless functions and calculations to slow reverse engineering and make the code harder to understand.
Encrypted staging and traffic: Its stages and communications were encrypted to hide their contents from inspection.
Direct system calls: From early 2024, Pikabot began invoking system functions directly instead of relying on standard libraries that endpoint tools commonly monitor.
Language checks: It checked the configured language on the host and declined to run on systems set to Russian or Ukrainian.

These techniques were designed to defeat individual observation points. They did not remove the need for the loader to execute, contact its infrastructure, and launch the next stage. Those actions remained available to behavioral detection.

The Qakbot connection

Pikabot is often called Qakbot's successor, but that description needs precision. Three separate connections are easy to confuse.

First, Pikabot's code showed similarities to Matanbuchus, another loader, in its handling of traffic and string encryption. This is the closest documented code connection and points toward Matanbuchus rather than Qakbot.

Second, the TLS certificate patterns on Pikabot's command-and-control servers resembled Qakbot's. This suggests shared infrastructure tradecraft or shared operators, rather than shared code.

Third, and most importantly, one of Qakbot's largest distributors switched to Pikabot after the August 2023 takedown. Pikabot inherited Qakbot's place in the criminal supply chain without inheriting its code.

Calling Pikabot a successor captures the market position and misdescribes the technical lineage. That distinction matters because defenders looking for code similarities may investigate the wrong family.

How Pikabot was delivered

Distribution was dominated by email, with the social engineering carrying most of the attacker's advantage.

Documented Pikabot delivery channels
Channel	How it worked	Period
Thread-hijacked phishing	Malicious replies were inserted into existing email conversations, so the message arrived inside a thread the recipient already trusted.	From February 2023
Phishing with embedded download links	Emails carried a URL in the body or an attachment, leading through several intermediate files to the loader.	Throughout 2023 and into 2024
HTML smuggling	An attached HTML page assembled the archive locally in the browser, so no recognizable archive crossed the email gateway.	Used within the campaigns above
Malvertising	A paid search advertisement promoted a lookalike site for a widely used remote access tool and served a signed installer.	December 2023

Thread hijacking was especially effective. A malicious reply inside a genuine conversation arrives from a correspondent the recipient already knows and trusts. The technique depends on a prior compromise somewhere in the thread, so it can defeat training built around recognizing unfamiliar senders.

The shift to paid search advertising in December 2023 placed Pikabot briefly in the same fake-installer economy as other loader families. Sekoia observed a sharp increase in new command-and-control servers after this change, consistent with a rise in successful infections.

What infrastructure tracking revealed

Sekoia analysts tracked Pikabot's command-and-control infrastructure continuously from its emergence, collecting more than 360 unique server addresses between February 2023 and early May 2024. The servers used unusual ports, so coverage depended on combining proactive scanning heuristics with configuration extracted from samples.

Early servers presented TLS certificates and web pages impersonating well-known technology brands. The TDR team assessed that this had the opposite of the intended effect. Impersonating a specific brand created a distinctive, trackable pattern that made the servers easier to find than a generic response would have. From November 2023, the operators abandoned the impersonation and reverted to less distinctive responses.

Infrastructure telemetry also revealed the operation's tempo: an initial test campaign, a quiet development period, renewed activity in mid-2023, weekly server deployment through the autumn after the Qakbot takedown, a pause around the Orthodox Christmas holiday, a brief resumption, and a steady decline from February to April 2024.

That tracking supported Sekoia's most important assessment: Pikabot's campaigns aligned so closely with one distributor's activity that the distributor was likely the primary, and possibly the only, user of the malware.

Operation Endgame and why Pikabot stayed down

Between 27 and 29 May 2024, an international law enforcement action coordinated across several countries seized around 100 servers, took control of more than 2,000 domains, and targeted infrastructure behind loaders and droppers that fed ransomware operations. Pikabot was among the families disrupted. Sekoia TDR contributed cyber threat intelligence on Pikabot to French law enforcement as part of the operation.

Pikabot had already been fading before the takedown, with email distribution declining from around March 2024. After Operation Endgame, it did not resume and was absent from the follow-up phase of the same operation the following year. On the available evidence, the malware is finished rather than dormant.

The likely reason is structural. A loader sold to many customers can survive the loss of one operator because the market creates demand for rebuilding. Pikabot had effectively one user. Once its infrastructure was removed, there was no broad customer base demanding restoration and no revenue stream supporting it. The distributor had an incentive to move to a working alternative instead.

Concentrated use made Pikabot dependable for its distributor and vulnerable to disruption. That is a useful lesson for threat intelligence: the commercial structure behind malware can predict resilience as much as the code itself.

What Pikabot tells defenders

Treat loader detections as intrusions. The loader is the least important thing on the machine. The first question is what it fetched before detection.
Thread hijacking breaks sender-trust heuristics. Controls built around unfamiliar senders do not address a malicious reply inside a genuine conversation.
Takedowns disrupt supply, not demand. Removing Qakbot created the opening Pikabot filled within weeks. New loaders can absorb the same displaced distributors.
Cover more than userland API calls. Pikabot's move to direct system calls was aimed at endpoint tools monitoring standard libraries, which supports detection across multiple observation points.
Track infrastructure alongside samples. Server telemetry revealed scale, development phases, and dormancy that sample collection alone would have missed.
Look for concentrated use. A malware family with one primary customer may be more vulnerable to a targeted disruption than a broadly sold service.

How to detect and respond to Pikabot-style loaders

Pikabot is no longer active, but the defensive controls associated with it remain relevant to other loaders:

Monitor thread-hijacked email. Inspect unusual replies, unexpected links, and attachments added to existing conversations.
Detect staged execution. Look for a process that unpacks, contacts new infrastructure, and injects code into another process shortly after delivery.
Monitor analysis-evasion behavior. Sandbox checks, debugger detection, encrypted staging, and direct system calls can form part of a useful behavioral picture.
Correlate endpoint and network telemetry. A single command or connection may be legitimate. The sequence of execution, injection, and command-and-control is more informative.
Investigate the second stage. Identify whether Cobalt Strike, Meterpreter, an infostealer, or ransomware followed the loader, then review persistence, credentials, and lateral movement.

Expert insight: The loader with one customer was the one that stayed dead

Compare two types of loaders. One is sold as a subscription to a limited but real customer base, with pricing tiers, support, and an administration panel. It may decline in prominence without disappearing, and its delivery model can spread to other operators. The other is engineered to a high standard but used by essentially one distributor. Law enforcement takes down its infrastructure once, and it never returns.

The lesson is that resilience in criminal tooling comes from distribution of demand as much as from quality of code. Pikabot had extensive anti-analysis engineering, a deliberate multi-stage design, and an active development cycle. Those capabilities did not help after its servers were removed because there was no broad customer base asking for the service to return. When assessing how durable a threat is, the commercial structure behind it can predict more than the malware's technical capability.

Sekoia is a European cybersecurity vendor whose TDR team tracked Pikabot and its infrastructure from emergence, published technical research, and provided intelligence to French law enforcement that supported the operation that disrupted it. Sekoia Intelligence continues to monitor loader ecosystems, while the Sekoia AI SOC platform correlates the endpoint, network, and identity behaviors that remain relevant when the next loader replaces the last one.