Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security

**PikaBot** is a modular backdoor/loader active since early 2023 that is distributed primarily via phishing email campaigns and multi-stage delivery (auto-downloaded ZIPs, PDFs with embedded URLs, Excel SMB links, ISO attachments). The malware features a loader and core component capable of injecting shellcode/DLLs/executables, employs evasion techniques (ADVobfuscator, anti-analysis, sleep via NtContinue, geolocation checks), leverages DLL search order hijacking and CVE-2023-33151 in deliveries, and commonly acts as a conduit for secondary payloads like infostealers or ransomware.