Loki RAT
- First seen
- 2020-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Last IoC activity
- 2026-06-10 16:55:49
- Profile updated
- 2026-07-07 14:40:12
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
This RAT written in Python is an open-source fork of the Ares RAT. This malware integrates additional modules, like recording, lockscreen, and locate options. It was used in a customized form version by El Machete APT in an ongoing champaign since 2020. The original code can be found at: https://github.com/TheGeekHT/Loki.Rat/
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Py.Lokirat (report)
- youtube.com — Watch (report)
- research.checkpoint.com — State Sponsored Attack Groups Capitalise On Russia Ukraine War For Cyber Espionage (report)
- first.org — Firstcon23 Tlpclear Sood Compromising The Keys To The Kingdom (report)
- rekings.com — Loki Rat Php Rat (report)