LODEINFO

LODEINFO is a continuously developed fileless Windows backdoor used in long-running cyber-espionage operations since late 2019. It has been closely associated with campaigns targeting organizations in Japan, including government, diplomacy, media, defense, think tanks, academia, and related strategic sectors, and later reporting also linked its use to activity affecting Taiwan and India. The malware is widely associated with the China-aligned MirrorFace cluster, also tracked as Earth Kasha, and some reporting places that activity within or adjacent to the broader APT10 umbrella. LODEINFO has also been described as tooling unique to MirrorFace in multiple intrusion sets.

LODEINFO is commonly delivered through targeted spearphishing emails carrying malicious Microsoft Office documents, especially Word documents and in earlier cases Excel files. Infection chains have relied on macro execution, password-protected lure documents, remote template injection, and Living-off-the-Land execution methods. Across multiple campaigns, operators also used legitimate signed executables to side-load malicious DLL components that ultimately decode and load the LODEINFO payload in memory. Later variants embedded architecture-specific downloader shellcode, performed environment or language checks, and increased obfuscation through techniques such as control-flow flattening, junk code insertion, encoded shellcode fragments, and evolving API hashing and command obfuscation schemes.

The malware functions as a remote-access backdoor with a broad command set for post-compromise operations. Documented capabilities include execution of commands, PE files, and shellcode; file upload and download; file and directory management; screenshot capture; process listing and termination; WMI-based execution; configuration handling; and in-memory injection into remote processes. Some versions supported 64-bit shellcode injection in addition to 32-bit execution. LODEINFO has also implemented keylogging, storing captured keystrokes with local encoding or encryption, and has been observed collecting browser cookies. It supports reconnaissance through commands such as network discovery using native utilities. Persistence-related functionality has appeared in several versions, and operators have repeatedly modified execution flows to improve stealth and resilience.

LODEINFO uses custom and evolving command-and-control protections. Reported variants employed layered encryption and encoding schemes for beaconing and tasking, including AES-based protection, XOR operations, modified Base64 handling, and repeated Vigenere-cipher transformations, along with custom data structures for embedded server information and command identifiers. Beacon data has included host metadata such as hostname, locale or language information, time, code page, and network adapter details. The malware’s developers have repeatedly changed communication formats, API resolution logic, and command encoding to frustrate signature-based detection and reverse engineering.

Several versions introduced or restored additional commands over time, showing active maintenance and feature expansion through at least 2024. Among the more notable functions, some builds included a ransomware-style file-encryption command using hybrid cryptography, although reporting has characterized LODEINFO primarily as an espionage backdoor rather than ransomware. Overall, LODEINFO is best understood as a mature, adaptable espionage implant centered on stealthy in-memory execution, DLL side-loading, and sustained targeting of high-value organizations in East Asia and related geopolitical contexts.