SYMBOLCOMMON_NAMEaka. SYNONYMS
win.picasso_loader (Back to overview)

PicassoLoader

Actor(s): Ghostwriter

There is no description at this point.

References
2026-05-14 ⋅ ESET Research ⋅ ESET Research
FrostyNeighbor: Fresh mischief and digital shenanigans
Cobalt Strike PicassoLoader
2025-12-05 ⋅ StrikeReady ⋅ StrikeReady Labs
Captch-ya if you can
PicassoLoader
2025-08-20 ⋅ HarfangLab ⋅ HarfangLab CTR
UAC-0057 keeps applying pressure on Ukraine and Poland
PicassoLoader
2024-07-25 ⋅ SOC Prime ⋅ Veronika Telychko
UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon
Cobalt Strike PicassoLoader Ghostwriter
2023-07-07 ⋅ Cert-UA ⋅ Cert-UA
UAC-0057 Targeted Cyber ​​Attack Against Government Agencies Using PicassoLoader/njRAT (CERT-UA#6948)
PicassoLoader Ghostwriter
2023-06-16 ⋅ SOC Prime ⋅ Veronika Telychko
PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution
Cobalt Strike PicassoLoader Ghostwriter

There is no Yara-Signature yet.