PhotoLoader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A loader used to deliver IcedID, fetching a fake image from which payloads are extracted.

Threat Analysis

PhotoLoader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://0x0d4y.blog/icedid-technical-analysis/

→https://awakesecurity.com/blog/detecting-icedid-and-cobalt-strike-beacon-with-network-detection-and-response/

→https://blog.talosintelligence.com/following-the-lnk-metadata-trail

→https://blog.unpac.me/2023/05/03/unpacme-weekly-new-version-of-icedid-loader

→https://isc.sans.edu/diary/28636

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

win.photoloaderPhotoLoaderGZIPLOADER

External Intelligence

Malpedia: win.photoloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PhotoLoader