PicassoLoader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.picasso_loader

Threat Analysis

PicassoLoader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cert.gov.ua/article/5098518

→https://harfanglab.io/insidethelab/uac-0057-pressure-ukraine-poland/

→https://socprime.com/blog/picassoloader-and-cobalt-strike-beacon-detection-uac-0057-aka-ghostwriter-hacking-group-attacks-the-ukrainian-leading-military-educational-institution/

→https://socprime.com/blog/uac-0057-attack-detection-a-surge-in-adversary-activity-distributing-picassoloader-and-cobalt-strike-beacon/

→https://strikeready.com/blog/captch-ya-if-you-can/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.picasso_loaderPicassoLoader

External Intelligence

Malpedia: win.picasso_loader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PicassoLoader