Loading malware…
LoptikMod is a Windows remote access trojan associated with the India-linked DoNot Team, also tracked as APT-C-35, Mint Tempest, Origami Elephant, SECTOR02, and Viceroy Tiger. It has been reported in DoNot espionage operations since at least 2018 and has been used against government, diplomatic, defense, and NGO targets, including European foreign ministries.
LoptikMod is typically delivered through spearphishing emails that impersonate officials and use diplomatic or defense-themed lures. Observed campaigns used password-protected archives containing a malicious executable disguised as a document. Once executed, the malware establishes persistence through scheduled tasks, enforces single-instance execution, performs host reconnaissance, and communicates with command-and-control infrastructure over encrypted web traffic.
Its functionality includes collecting system and host-identification data, receiving operator commands, downloading additional modules or payloads, and exfiltrating information from compromised systems. Reported tradecraft includes string obfuscation, selective packing, runtime API resolution, anti-virtualization checks, and cleanup steps intended to reduce forensic visibility. The malware’s behavior and targeting are consistent with long-term surveillance and cyber-espionage objectives rather than disruptive or destructive operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The telemetry and analysis of the payload associated this attack with "LoptikMod" malware, reportedly used exclusively by DoNot APT since 2018.
The telemetry and analysis of the payload associated this attack with "LoptikMod" malware, reportedly used exclusively by DoNot APT since 2018.
The telemetry and analysis of the payload associated this attack with "LoptikMod" malware, reportedly used exclusively by DoNot APT since 2018.
The telemetry and analysis of the payload associated this attack with "LoptikMod" malware, reportedly used exclusively by DoNot APT since 2018.
The telemetry and analysis of the payload associated this attack with "LoptikMod" malware, reportedly used exclusively by DoNot APT since 2018.
The telemetry and analysis of the payload associated this attack with "LoptikMod" malware, reportedly used exclusively by DoNot APT since 2018.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence Scheduled Task/Job: Scheduled Task T1053.005 Creates scheduled tasks: “PerformTaskMaintain” “MicorsoftVelocity”
It also employs anti-VM techniques and ASCII obfuscation to hinder execution in virtual environments and evade analysis
Instead of directly importing APIs, malware can load them dynamically at runtime. This is done using functions like `LoadLibrary` ... and `GetProcAddress` ...
Defense Evasion Obfuscated Files or Information: Encrypted/Encoded File T1027.013 Encoded ASCII strings in file Notflog.exe
The RAR archive distributed via the emails contains a malicious executable that mimics a PDF document.
The malware gathers system details, including the CPU model, operating system name and build, username, hostname, CPU ProcessorID, and a list of installed software.
Discovery File and Directory Discovery T1083 Search for %localappdata% in user environment
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom DoNot APT backdoor/RAT delivered via a spear-phishing chain using a malicious RAR archive. It executes as notflog.exe, drops batch files for staging, establishes persistence via scheduled tasks, performs anti-VM checks, dynamically resolves APIs, collects host information, encrypts and Base64-encodes data, communicates with a C2 over HTTPS, and can download follow-on payloads such as socker.dll.
Malware used by DoNot Team in espionage targeting a European foreign affairs ministry (per summary).
A malware used by the DoNot threat group, delivered via phishing, that enables surveillance of infected victims.
LoptikMod is a remote access trojan (RAT) used by the DoNot Team for cyber espionage. It is capable of establishing persistence, exfiltrating data, executing commands, and downloading additional payloads. It employs anti-VM checks, ASCII obfuscation, and ensures only one active instance runs at a time to evade detection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.