APT / THREAT GROUP

Loda

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as “Trojan.Nymeria”, although the connection is not well-documented.

Threat Analysis

Loda is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html

→https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html

→https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html

→https://blog.talosintelligence.com/attributing-yorotrooper/

→https://blog.talosintelligence.com/get-a-loda-this/

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

LodaRATLodaNymeriawin.loda

External Intelligence

Malpedia: win.loda

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Loda