# APT10 LODEINFO Malware Evolution: v0.6.6 - v0.7.3 Analysis

> ITOCHU Cyber & Intelligence analyzes LODEINFO fileless backdoor versions v0.6.6 through v0.7.3, attributed to APT10 and used against Japanese media, diplomatic, public-sector, defense-industry and think-tank targets. Techniques include remote template injection, DLL side-loading (Elze.exe / Frau.dll), control-flow flattening and in-memory deployment.

- **Published:** 2026-10-30T19:10:02Z
- **Last reviewed:** 2026-10-30T19:10:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4849
- **ID:** TL-2026-4849
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT10 (China)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LODEINFO is a fileless backdoor delivered by spear-phishing since December 2019 and first named by JPCERT/CC in February 2020. ITOCHU Cyber & Intelligence (published 2024-01-24) documents versions v0.6.6 through v0.7.3. The infection chain starts with a malicious Word attachment whose macro selects 32-bit or 64-bit downloader shellcode according to OS architecture. From v0.6.9 the document uses remote template injection: Word fetches a template (for example https://45.76.222.130/template.dotm) from attacker infrastructure, and the template's VBA carries the shellcode, which keeps the initial document cleaner and harder to detect.

The decrypted payload contains three objects: a legitimate host executable (Elze.exe), a malicious side-loaded library (Frau.dll) and an XOR-encoded LODEINFO shellcode blob (Elze.exe_bak). Frau.dll decodes the blob and injects the backdoor into memory, so LODEINFO runs without a file artifact. Obfuscation includes control-flow flattening, junk code, Base64-fragmented VBA shellcode reassembled at run time, and self-patching shellcode that decodes itself with an incrementing XOR key (0x00-0xFF). Version 0.7.0 changed the API-name hashing logic and uses a per-sample hardcoded XOR key. Version 0.7.0 also added a check for Japanese Microsoft Office language settings, which v0.7.1 removed, indicating possible expansion beyond Japanese-language environments. Filenames shifted from Japanese to English.

Version 0.7.1 introduced an intermediate stage disguised as a PEM file. It is decoded by stripping the header and footer, Base64-decoding, removing a 3-byte header, deriving a key with HMAC-SHA1 from a hardcoded password, decrypting with AES and applying a single-byte XOR. The backdoor then loads directly in memory. C2 traffic uses multiple Vigenere cipher layers and command IDs hidden with a 2-byte XOR. The backdoor exposes about 18-22 commands (command, ls, rm, mv, cp, cat, mkdir, send, recv, memory, kill, cd, ver, print, ransom, comc, config, runas, keylog, ps, pkill, autorun). keylog, ps, pkill and autorun were restored in v0.7.2/v0.7.3, runas was added in v0.7.1 and config was implemented in v0.7.2. keylog writes keystrokes and timestamps to %temp%%hostname%.tmp.

The downloader shares traits with DOWNIISSA (self-patching, C2 data encoding, decrypted data structure) previously documented by Kaspersky in 2022; earlier Kaspersky analysis also described K7Security-binary DLL side-loading and process injection into msiexec.exe. ITOCHU attributes the activity to APT10 on the basis of TTP similarity and malware relationships; infrastructure favors AS-CHOOPA (Vultr) hosting and was consistent across 2023 versions. Trend Micro tracks overlapping activity as Earth Kasha and cautions that evidence for definitive APT10 attribution is limited, using an 'APT10 Umbrella' term for related intrusion sets; it additionally reports a 2023-2024 campaign using public-facing application exploits to deploy LODEINFO, NOOPDOOR and Cobalt Strike (not part of the ITOCHU analysis). ITOCHU recommends endpoint products capable of in-memory scanning, since both downloader and backdoor are fileless.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1221 Template Injection
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1614.001 System Language Discovery
- T1057 Process Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Sources

- [The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis](https://blog-en.itochuci.co.jp/entry/2024/01/24/134100)
- [APT10: Tracking down LODEINFO 2022, Part I (Kaspersky Securelist)](https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/)
- [LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks (The Hacker News)](https://thehackernews.com/2024/01/lodeinfo-fileless-malware-evolves-with.html)
- [LODEINFO Campaign of Earth Kasha (Trend Micro)](https://www.trendmicro.com/ru_ru/research/24/k/lodeinfo-campaign-of-earth-kasha.html)
- [China-Backed APT10 Supercharges Spy Game With Custom Fileless Backdoor (Dark Reading)](https://www.darkreading.com/threat-intelligence/china-backed-apt10-spy-game-custom-fileless-backdoor)
- [Hacking group abuses antivirus software to launch LODEINFO malware (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hacking-group-abuses-antivirus-software-to-launch-lodeinfo-malware/)
- [Trend Micro Earth Kasha IOC list](https://documents.trendmicro.com/assets/txt/EarthKasha_IOC84gIFsv.txt)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4849