Threat reportMalwareTL-2026-4849
APT10 LODEINFO Malware Evolution: v0.6.6 - v0.7.3 Analysis
APT10 LODEINFO Malware Evolution (TL-2026-4849), also tracked as LODEINFO, is a high-severity malware campaign, first published 2026-10-30. It is attributed to APT10 (China) with medium confidence, affects Microsoft Microsoft Word / Office (macro and remote template abuse), maps to 15 MITRE ATT&CK techniques (T1027, T1055, T1056.001), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1APT10
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-4849
- Threat ID
- TL-2026-4849
- Also known as
- LODEINFO, DOWNIISSA
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT10
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- news - media, government administration, diplomacy, defense, think-tank
- Target regions
- japan
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in APT10 LODEINFO Malware Evolution
Malware and tooling: DOWNIISSA - S9021, LODEINFO - S9020
How APT10 LODEINFO Malware Evolution works
ITOCHU Cyber & Intelligence analyzes LODEINFO fileless backdoor versions v0.6.6 through v0.7.3, attributed to APT10 and used against Japanese media, diplomatic, public-sector, defense-industry and think-tank targets. Techniques include remote template injection, DLL side-loading (Elze.exe / Frau.dll), control-flow flattening and in-memory deployment.
LODEINFO is a fileless backdoor delivered by spear-phishing since December 2019 and first named by JPCERT/CC in February 2020. ITOCHU Cyber & Intelligence (published 2024-01-24) documents versions v0.6.6 through v0.7.3. The infection chain starts with a malicious Word attachment whose macro selects 32-bit or 64-bit downloader shellcode according to OS architecture. From v0.6.9 the document uses remote template injection: Word fetches a template (for example https://45.76.222.130/template.dotm) from attacker infrastructure, and the template's VBA carries the shellcode, which keeps the initial document cleaner and harder to detect.
The decrypted payload contains three objects: a legitimate host executable (Elze.exe), a malicious side-loaded library (Frau.dll) and an XOR-encoded LODEINFO shellcode blob (Elze.exe_bak). Frau.dll decodes the blob and injects the backdoor into memory, so LODEINFO runs without a file artifact. Obfuscation includes control-flow flattening, junk code, Base64-fragmented VBA shellcode reassembled at run time, and self-patching shellcode that decodes itself with an incrementing XOR key (0x00-0xFF). Version 0.7.0 changed the API-name hashing logic and uses a per-sample hardcoded XOR key. Version 0.7.0 also added a check for Japanese Microsoft Office language settings, which v0.7.1 removed, indicating possible expansion beyond Japanese-language environments. Filenames shifted from Japanese to English.
Version 0.7.1 introduced an intermediate stage disguised as a PEM file. It is decoded by stripping the header and footer, Base64-decoding, removing a 3-byte header, deriving a key with HMAC-SHA1 from a hardcoded password, decrypting with AES and applying a single-byte XOR. The backdoor then loads directly in memory. C2 traffic uses multiple Vigenere cipher layers and command IDs hidden with a 2-byte XOR. The backdoor exposes about 18-22 commands (command, ls, rm, mv, cp, cat, mkdir, send, recv, memory, kill, cd, ver, print, ransom, comc, config, runas, keylog, ps, pkill, autorun). keylog, ps, pkill and autorun were restored in v0.7.2/v0.7.3, runas was added in v0.7.1 and config was implemented in v0.7.2. keylog writes keystrokes and timestamps to %temp%%hostname%.tmp.
The downloader shares traits with DOWNIISSA (self-patching, C2 data encoding, decrypted data structure) previously documented by Kaspersky in 2022; earlier Kaspersky analysis also described K7Security-binary DLL side-loading and process injection into msiexec.exe. ITOCHU attributes the activity to APT10 on the basis of TTP similarity and malware relationships; infrastructure favors AS-CHOOPA (Vultr) hosting and was consistent across 2023 versions. Trend Micro tracks overlapping activity as Earth Kasha and cautions that evidence for definitive APT10 attribution is limited, using an 'APT10 Umbrella' term for related intrusion sets; it additionally reports a 2023-2024 campaign using public-facing application exploits to deploy LODEINFO, NOOPDOOR and Cobalt Strike (not part of the ITOCHU analysis). ITOCHU recommends endpoint products capable of in-memory scanning, since both downloader and backdoor are fileless.
MITRE ATT&CK techniques used in TL-2026-4849
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1221 Template Injection; T1574.001 DLL; T1620 Reflective Code Loading
Collection
T1056.001 Keylogging; T1113 Screen Capture
Discovery
T1057 Process Discovery; T1614.001 System Language Discovery
Execution
T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1573.001 Symmetric Cryptography
Initial Access
Affected products and versions in APT10 LODEINFO Malware Evolution
Remediation for APT10 LODEINFO Malware Evolution
Immediate actions
- Block the listed C2 IPs (167.179.106.224, 167.179.77.72, 172.104.112.218, 202.182.116.25, 45.76.197.236, 45.76.222.130, 45.77.183.161) at the perimeter and hunt historical connections
- Search endpoints for Elze.exe paired with Frau.dll and for the listed MD5 hashes
- Quarantine inbound Word documents with macros or remote template references (.dotm) pending review
Workarounds
- Disable VBA macros by Group Policy for users who do not require them
- Restrict Office outbound network access to trusted destinations
Longer-term hardening
- Deploy EDR/endpoint tooling with in-memory scanning to detect fileless shellcode
- Enforce Microsoft Office policy blocking macros from the internet and external template loading
- Monitor for DLL side-loading of legitimate signed executables from user-writable paths
Timeline of APT10 LODEINFO Malware Evolution
- Spear-phishing campaigns with malicious Word attachments delivering LODEINFO begin (December 2019, per ITOCHU).
- JPCERT/CC first names LODEINFO in a blog post and attributes it to APT10 (February 2020).
- Politician-themed self-extracting archive deploying LODEINFO observed (per Kaspersky); DOWNIISSA downloader also discovered around June 2022.
- Kaspersky publishes initial documentation of LODEINFO 2022 activity and DOWNIISSA (November 2022).
- LODEINFO v0.7.0 adds a Japanese Office language check and new API-name hashing with per-sample XOR keys (around June 2023).
- Language check removed in v0.7.1 and fake PEM intermediate stage introduced, indicating targeting beyond Japanese-language environments (around July 2023).
- Versions v0.7.2 and v0.7.3 observed restoring keylog, ps, pkill and autorun commands and implementing config (late 2023 per ITOCHU).
- ITOCHU Cyber & Intelligence publishes analysis of LODEINFO v0.6.6 through v0.7.3 with IOCs.
Sources cited for APT10 LODEINFO Malware Evolution
- The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis
- APT10: Tracking down LODEINFO 2022, Part I (Kaspersky Securelist)
- LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks (The Hacker News)
- LODEINFO Campaign of Earth Kasha (Trend Micro)
- China-Backed APT10 Supercharges Spy Game With Custom Fileless Backdoor (Dark Reading)
- Hacking group abuses antivirus software to launch LODEINFO malware (BleepingComputer)
- Trend Micro Earth Kasha IOC list
Detection coverage for TL-2026-4849
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4849 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.