MALWARE FAMILY

Loda

Internal ID: win.loda

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as “Trojan.Nymeria”, although the connection is not well-documented.

Threat Analysis

Loda is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html

→https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html

→https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html

→https://blog.talosintelligence.com/attributing-yorotrooper/

→https://blog.talosintelligence.com/get-a-loda-this/

→https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/

→https://mp.weixin.qq.com/s/mstwBMkS0G3Et4GOji2mwA

→https://ti.qianxin.com/blog/articles/Kasablanka-Group-Probably-Conducted-Compaigns-Targeting-Russia/

→https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel

→https://www.proofpoint.com/us/threat-insight/post/introducing-loda-malware

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.loda

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Loda