Lokibot
Software · ATTACK:enterprise:S0447
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0447",
"title": "Lokibot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0447",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--cb741463-f0fe-42e0-8d45-bc7e8335f5ae",
"external_id": "S0447",
"domain": "enterprise",
"created": "2020-05-14T17:31:33.707Z",
"modified": "2025-04-25T14:44:41.863Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Lokibot"
},
{
"source_name": "Infoblox Lokibot January 2019",
"url": "https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22"
},
{
"source_name": "Morphisec Lokibot April 2020",
"url": "https://blog.morphisec.com/lokibot-with-autoit-obfuscator-frenchy-shellcode"
},
{
"source_name": "CISA Lokibot September 2020",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-266a"
},
{
"source_name": "Talos Lokibot Jan 2021",
"url": "https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0077d777-1e32-4b34-ab12-461b34110ffe
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--060894ab-c1ec-488c-8d66-25924c82ad58
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c5577aa-30c5-47f5-83f3-34260860e2b6
Infoblox Lokibot January 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dd73de5-d615-4455-a552-ff382ec75e82
Infoblox Lokibot January 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13bc2a82-c51d-4410-9e62-223df287b8f7
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f888716-1e49-4d8d-b693-67c6eae8a775
Infoblox Lokibot January 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--203e48b0-5175-4cc9-9e49-8cae08f26f52
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33a464ab-cc0d-436d-9bcd-9d6e08994370
Infoblox Lokibot January 2019 · Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ccef052-7ac9-47b1-9be6-8c140f279941
FSecure Lokibot November 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53339b8f-f66b-4bcc-86a8-31daaeebb0e6
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6494b2d2-8f8f-4e81-886c-dadd57df6edc
FSecure Lokibot November 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65692352-9f25-4410-b715-5cdce6ee25cd
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--710919f6-2c74-4f41-be51-af848ad691af
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--754699a2-fa2c-4ac2-82cc-be6b7c0c8a6b
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76f712e1-cc4c-43a2-b6a7-c288ac206aac
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cafb7b2-5227-4340-b531-7bd134645d30
FSecure Lokibot November 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1053
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85b5efa3-9bd0-4685-a211-78f17a3747c7
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--892763cd-4967-49f6-b8a8-212a6f18a19b
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9e6a51e-69b1-4b21-9db1-5aabdded2f0a
FSecure Lokibot November 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab90bb4c-96d2-4c01-ac66-fe8bf585d88c
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af1fc367-9987-4076-9ce6-2414cd2d4a1f
Infoblox Lokibot January 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cafdf392-1a61-422f-80ca-4d0d088bd44a
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d331f4b3-047a-4418-9611-f2b8445692b3
FSecure Lokibot November 2019ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5bac840-bebe-4209-b16d-b6ae9ff96982
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da33f077-8ce2-4a2d-a8ed-f9f21799c80e
TrendMicro Msiexec Feb 2018 · Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e129d95a-e98e-4bf8-b065-57651dc3335d
Infoblox Lokibot January 2019 · Talos Lokibot Jan 2021ATTACK:enterprise:G0083 → uses → ATTACK:enterprise:S0447
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8948840-b0a0-4c10-87f4-022720dc8dd9
Unit42 SilverTerrier 2018ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7328802-07f4-4f00-821a-962fb2678e15
Talos Lokibot Jan 2021ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe69bcdd-8df4-44e3-8994-b46e4d4c8aac
Infoblox Lokibot January 2019