APT10__2024__The_Endless_Struggle_Against_APT10_Insights_from_LODEINFO_v0.6.6_-_v0.7.3_Analysis_-_Researcher_Blog_-_ITOCHU_Cyber_Intelligence_Inc.pdf

LODEINFO is an actively developed, fileless backdoor observed from 2022–2024 that infects targets via spear‑phishing Word documents (including Remote Template Injection), uses 32/64‑bit downloader shellcode to fetch and decrypt a fake PEM containing staged components (legitimate EXE + malicious DLL) and loads an in‑memory backdoor; the report details version differences up to v0.7.3, advanced anti‑analysis and obfuscation techniques, available IoCs (hashes and C2 IPs), and links to APT activity consistent with prior APT10 reporting.