{
	"id": "a399f869-7950-4d8b-9ebf-0684c005789b",
	"created_at": "2026-04-06T00:17:21.600048Z",
	"updated_at": "2026-04-10T03:36:27.602356Z",
	"deleted_at": null,
	"sha1_hash": "9b0a95180c51fe4c587c02c2249e8ee3159b32f0",
	"title": "LaZagne (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 69973,
	"plain_text": "LaZagne (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 23:08:42 UTC\r\nLaZagne\r\nThe author described LaZagne as an open source project used to retrieve lots of passwords stored on a local\r\ncomputer. It has been developed for the purpose of finding these passwords for the most commonly-used software.\r\nIt is written in Python and provided as compiled standalone binaries for Linux, Mac, and Windows.\r\nReferences\r\n2025-03-20 ⋅ Cisco Talos ⋅ Asheer Malhotra, Brandon White, Jungsoo An, Vitor Ventura\r\nUAT-5918 targets critical infrastructure entities in Taiwan\r\nShortLeash LaZagne JuicyPotato Meterpreter MimiKatz ShortLeash UAT-5918\r\n2023-10-26 ⋅ Fourcore ⋅ parth gol\r\nThreat Hunting: Detecting Browser Credential Stealing [T1555.003]\r\nLaZagne RedLine Stealer\r\n2023-04-03 ⋅ Mandiant ⋅ Eduardo Mattos, JASON DEYALSINGH, Nick Richard, NICK SMITH, Tyler McLellan\r\nALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access\r\nLaZagne BlackCat MimiKatz\r\n2022-10-03 ⋅ Kaspersky Labs ⋅ GReAT\r\nDeftTorero: tactics, techniques and procedures of intrusions revealed\r\nNightrunner Tunna ASPXSpy LaZagne ExplosiveRAT reGeorg Volatile Cedar\r\n2022-06-20 ⋅ ⋅ Infinitum IT ⋅ infinitum IT\r\nCharming Kitten (APT35)\r\nLaZagne DownPaper MimiKatz pupy\r\n2022-05-17 ⋅ Trend Micro ⋅ Trend Micro Research\r\nRansomware Spotlight: RansomEXX\r\nLaZagne Cobalt Strike IcedID MimiKatz PyXie RansomEXX TrickBot\r\n2022-05-09 ⋅ The DFIR Report ⋅ The DFIR Report\r\nSEO Poisoning – A Gootloader Story\r\nGootLoader LaZagne Cobalt Strike GootKit\r\n2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli\r\nCommand and Control Traffic Patterns\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/py.lazagne\r\nPage 1 of 2\n\nostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID\r\nISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot\r\n2020-12-09 ⋅ Avast Decoded ⋅ Igor Morgenstern, Luigino Camastra\r\nAPT Group Targeting Governmental Agencies in East Asia\r\nLaZagne Albaniiutas HyperBro MimiKatz PolPo Tmanger TaskMasters\r\n2020-11-30 ⋅ Yoroi ⋅ Antonio Pirozzi, Luca Mella, Luigi Martire\r\nShadows From The Past Threaten Italian Enterprises\r\nRekoobe LaZagne Responder MimiKatz win.rekoobe\r\n2020-11-20 ⋅ Trend Micro ⋅ Abraham Camba, Bren Matthew Ebriega, Gilbert Sison\r\nWeaponizing Open Source Software for Targeted Attacks\r\nLaZagne Defray PlugX\r\n2020-09-14 ⋅ Github (AlessandroZ) ⋅ AlessandroZ\r\nThe LaZagne Project !!!\r\nLaZagne\r\n2020-08-01 ⋅ Group-IB ⋅ Group-IB\r\nRedCurl: The pentest you didn’t know about\r\nLaZagne\r\n2020-05-08 ⋅ MITRE ⋅ MITRE ATT\u0026CK\r\nInception\r\nPowerShower LaZagne\r\n2020-05-08 ⋅ MITRE ⋅ MITRE ATT\u0026CK\r\nInception\r\nPowerShower LaZagne Inception Framework\r\nThere is no Yara-Signature yet.\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/py.lazagne\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/py.lazagne\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/py.lazagne"
	],
	"report_names": [
		"py.lazagne"
	],
	"threat_actors": [
		{
			"id": "82b92285-4588-48c9-8578-bb39f903cf62",
			"created_at": "2022-10-25T15:50:23.850506Z",
			"updated_at": "2026-04-10T02:00:05.418577Z",
			"deleted_at": null,
			"main_name": "Charming Kitten",
			"aliases": [
				"Charming Kitten"
			],
			"source_name": "MITRE:Charming Kitten",
			"tools": [
				"DownPaper"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "846522d7-29cb-4a0c-8ebe-ffba7429e2d7",
			"created_at": "2023-06-23T02:04:34.793629Z",
			"updated_at": "2026-04-10T02:00:04.971054Z",
			"deleted_at": null,
			"main_name": "Volt Typhoon",
			"aliases": [
				"Bronze Silhouette",
				"Dev-0391",
				"Insidious Taurus",
				"Redfly",
				"Storm-0391",
				"UAT-5918",
				"UAT-7237",
				"UNC3236",
				"VOLTZITE",
				"Vanguard Panda"
			],
			"source_name": "ETDA:Volt Typhoon",
			"tools": [
				"FRP",
				"Fast Reverse Proxy",
				"Impacket",
				"LOLBAS",
				"LOLBins",
				"Living off the Land"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d8af157e-741b-4933-bb4a-b78490951d97",
			"created_at": "2023-01-06T13:46:38.748929Z",
			"updated_at": "2026-04-10T02:00:03.087356Z",
			"deleted_at": null,
			"main_name": "APT35",
			"aliases": [
				"COBALT MIRAGE",
				"Agent Serpens",
				"Newscaster Team",
				"Magic Hound",
				"G0059",
				"Phosphorus",
				"Mint Sandstorm",
				"TunnelVision"
			],
			"source_name": "MISPGALAXY:APT35",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "6ec2cd63-307d-4281-86da-5dc199e932af",
			"created_at": "2025-08-07T02:03:24.821494Z",
			"updated_at": "2026-04-10T02:00:03.843522Z",
			"deleted_at": null,
			"main_name": "GOLD BLADE",
			"aliases": [
				"Earth Kapre ",
				"Red Wolf ",
				"RedCurl "
			],
			"source_name": "Secureworks:GOLD BLADE",
			"tools": [
				"RedLoader"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "ed4c7e37-461f-40f1-ad43-6ad7e21b32bc",
			"created_at": "2022-10-25T16:07:24.303712Z",
			"updated_at": "2026-04-10T02:00:04.929134Z",
			"deleted_at": null,
			"main_name": "TaskMasters",
			"aliases": [],
			"source_name": "ETDA:TaskMasters",
			"tools": [
				"404-Input-shell web shell",
				"ASPXSpy",
				"ASPXTool",
				"AtNow",
				"DbxDump Utility",
				"HTran",
				"HUC Packet Transmit Tool",
				"Mimikatz",
				"NBTscan",
				"PortScan",
				"ProcDump",
				"PsExec",
				"PsList",
				"RemShell",
				"RemShell Downloader",
				"gsecdump",
				"jsp File browser",
				"nbtscan",
				"pwdump",
				"reGeorg"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "77b28afd-8187-4917-a453-1d5a279cb5e4",
			"created_at": "2022-10-25T15:50:23.768278Z",
			"updated_at": "2026-04-10T02:00:05.266635Z",
			"deleted_at": null,
			"main_name": "Inception",
			"aliases": [
				"Inception Framework",
				"Cloud Atlas"
			],
			"source_name": "MITRE:Inception",
			"tools": [
				"PowerShower",
				"VBShower",
				"LaZagne"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "bc5c22a8-29eb-4a87-acd6-4817060e80f2",
			"created_at": "2022-10-25T15:50:23.658256Z",
			"updated_at": "2026-04-10T02:00:05.38013Z",
			"deleted_at": null,
			"main_name": "Volatile Cedar",
			"aliases": [
				"Volatile Cedar",
				"Lebanese Cedar"
			],
			"source_name": "MITRE:Volatile Cedar",
			"tools": [
				"Caterpillar WebShell"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "f72f2981-0dc4-4d96-857c-a725a143a538",
			"created_at": "2024-03-21T02:00:04.724563Z",
			"updated_at": "2026-04-10T02:00:03.602417Z",
			"deleted_at": null,
			"main_name": "Earth Kapre",
			"aliases": [
				"RedCurl",
				"Red Wolf",
				"GOLD BLADE"
			],
			"source_name": "MISPGALAXY:Earth Kapre",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "04a7ebaa-ebb1-4971-b513-a0c86886d932",
			"created_at": "2023-01-06T13:46:38.784965Z",
			"updated_at": "2026-04-10T02:00:03.099088Z",
			"deleted_at": null,
			"main_name": "Inception Framework",
			"aliases": [
				"Clean Ursa",
				"Cloud Atlas",
				"G0100",
				"ATK116",
				"Blue Odin"
			],
			"source_name": "MISPGALAXY:Inception Framework",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "4ae78ca3-8bc8-4d67-9df1-a85df250a8a0",
			"created_at": "2024-10-08T02:00:04.469211Z",
			"updated_at": "2026-04-10T02:00:03.726781Z",
			"deleted_at": null,
			"main_name": "TaskMasters",
			"aliases": [
				"BlueTraveller"
			],
			"source_name": "MISPGALAXY:TaskMasters",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "79e95381-8008-48dc-b981-fd66e1c46ca6",
			"created_at": "2022-10-25T16:07:24.110478Z",
			"updated_at": "2026-04-10T02:00:04.869039Z",
			"deleted_at": null,
			"main_name": "RedCurl",
			"aliases": [
				"Earth Kapre",
				"Red Wolf"
			],
			"source_name": "ETDA:RedCurl",
			"tools": [
				"Impacket",
				"LaZagne"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "029625d2-9734-44f9-9e10-b894b4f57f08",
			"created_at": "2023-01-06T13:46:38.364105Z",
			"updated_at": "2026-04-10T02:00:02.944092Z",
			"deleted_at": null,
			"main_name": "Charming Kitten",
			"aliases": [
				"iKittens",
				"Group 83",
				"NewsBeef",
				"G0058",
				"CharmingCypress",
				"Mint Sandstorm",
				"Parastoo"
			],
			"source_name": "MISPGALAXY:Charming Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "17b152bc-6f7e-463c-8b4c-a4844caea6df",
			"created_at": "2023-01-06T13:46:38.498795Z",
			"updated_at": "2026-04-10T02:00:03.000373Z",
			"deleted_at": null,
			"main_name": "Volatile Cedar",
			"aliases": [
				"Lebanese Cedar",
				"DeftTorero"
			],
			"source_name": "MISPGALAXY:Volatile Cedar",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e3676dfe-3d40-4b3a-bfbd-4fc1f8c896f4",
			"created_at": "2022-10-25T15:50:23.808974Z",
			"updated_at": "2026-04-10T02:00:05.291959Z",
			"deleted_at": null,
			"main_name": "Magic Hound",
			"aliases": [
				"Magic Hound",
				"TA453",
				"COBALT ILLUSION",
				"Charming Kitten",
				"ITG18",
				"Phosphorus",
				"APT35",
				"Mint Sandstorm"
			],
			"source_name": "MITRE:Magic Hound",
			"tools": [
				"Impacket",
				"CharmPower",
				"FRP",
				"Mimikatz",
				"Systeminfo",
				"ipconfig",
				"netsh",
				"PowerLess",
				"Pupy",
				"DownPaper",
				"PsExec"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6e23ce43-e1ab-46e3-9f80-76fccf77682b",
			"created_at": "2022-10-25T16:07:23.303713Z",
			"updated_at": "2026-04-10T02:00:04.530417Z",
			"deleted_at": null,
			"main_name": "ALPHV",
			"aliases": [
				"ALPHV",
				"ALPHVM",
				"Ambitious Scorpius",
				"BlackCat Gang",
				"UNC4466"
			],
			"source_name": "ETDA:ALPHV",
			"tools": [
				"ALPHV",
				"ALPHVM",
				"BlackCat",
				"GO Simple Tunnel",
				"GOST",
				"Impacket",
				"LaZagne",
				"MEGAsync",
				"Mimikatz",
				"Munchkin",
				"Noberus",
				"PsExec",
				"Remcom",
				"RemoteCommandExecution",
				"WebBrowserPassView"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "99c7aace-96b1-445b-87e7-d8bdd01d5e03",
			"created_at": "2025-08-07T02:03:24.746965Z",
			"updated_at": "2026-04-10T02:00:03.640335Z",
			"deleted_at": null,
			"main_name": "COBALT ILLUSION",
			"aliases": [
				"APT35 ",
				"APT42 ",
				"Agent Serpens Palo Alto",
				"Charming Kitten ",
				"CharmingCypress ",
				"Educated Manticore Checkpoint",
				"ITG18 ",
				"Magic Hound ",
				"Mint Sandstorm sub-group ",
				"NewsBeef ",
				"Newscaster ",
				"PHOSPHORUS sub-group ",
				"TA453 ",
				"UNC788 ",
				"Yellow Garuda "
			],
			"source_name": "Secureworks:COBALT ILLUSION",
			"tools": [
				"Browser Exploitation Framework (BeEF)",
				"MagicHound Toolset",
				"PupyRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "8108d548-e30f-4b90-aa60-71323ba66678",
			"created_at": "2024-11-01T02:00:52.667098Z",
			"updated_at": "2026-04-10T02:00:05.343786Z",
			"deleted_at": null,
			"main_name": "RedCurl",
			"aliases": [
				"RedCurl"
			],
			"source_name": "MITRE:RedCurl",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "5e7c75c6-097f-4d80-8c98-73485fe2a729",
			"created_at": "2022-10-25T16:07:24.386715Z",
			"updated_at": "2026-04-10T02:00:04.970172Z",
			"deleted_at": null,
			"main_name": "Volatile Cedar",
			"aliases": [
				"Amethyst Rain",
				"Dancing Salome",
				"DeftTorero",
				"G0123",
				"VolcanicTimber"
			],
			"source_name": "ETDA:Volatile Cedar",
			"tools": [
				"ASPXSpy",
				"ASPXTool",
				"Adminer",
				"DirBuster",
				"GoBuster",
				"JuicyPotato",
				"RottenPotato",
				"SharPyShell"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "7074cc97-be8f-417b-8294-124c3add8668",
			"created_at": "2025-05-29T02:00:03.190761Z",
			"updated_at": "2026-04-10T02:00:03.84828Z",
			"deleted_at": null,
			"main_name": "UAT-5918",
			"aliases": [],
			"source_name": "MISPGALAXY:UAT-5918",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "1699fb41-b83f-42ff-a6ec-984ae4a1031f",
			"created_at": "2022-10-25T16:07:23.83826Z",
			"updated_at": "2026-04-10T02:00:04.761303Z",
			"deleted_at": null,
			"main_name": "Magic Hound",
			"aliases": [
				"APT 35",
				"Agent Serpens",
				"Ballistic Bobcat",
				"Charming Kitten",
				"CharmingCypress",
				"Cobalt Illusion",
				"Cobalt Mirage",
				"Educated Manticore",
				"G0058",
				"G0059",
				"Magic Hound",
				"Mint Sandstorm",
				"Operation BadBlood",
				"Operation Sponsoring Access",
				"Operation SpoofedScholars",
				"Operation Thamar Reservoir",
				"Phosphorus",
				"TA453",
				"TEMP.Beanie",
				"Tarh Andishan",
				"Timberworm",
				"TunnelVision",
				"UNC788",
				"Yellow Garuda"
			],
			"source_name": "ETDA:Magic Hound",
			"tools": [
				"7-Zip",
				"AnvilEcho",
				"BASICSTAR",
				"CORRUPT KITTEN",
				"CWoolger",
				"CharmPower",
				"ChromeHistoryView",
				"CommandCam",
				"DistTrack",
				"DownPaper",
				"FRP",
				"Fast Reverse Proxy",
				"FireMalv",
				"Ghambar",
				"GoProxy",
				"GorjolEcho",
				"HYPERSCRAPE",
				"Havij",
				"MPK",
				"MPKBot",
				"Matryoshka",
				"Matryoshka RAT",
				"MediaPl",
				"Mimikatz",
				"MischiefTut",
				"NETWoolger",
				"NOKNOK",
				"PINEFLOWER",
				"POWERSTAR",
				"PowerLess Backdoor",
				"PsList",
				"Pupy",
				"PupyRAT",
				"SNAILPROXY",
				"Shamoon",
				"TDTESS",
				"WinRAR",
				"WoolenLogger",
				"Woolger",
				"pupy",
				"sqlmap"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "02c9f3f6-5d10-456b-9e63-750286048149",
			"created_at": "2022-10-25T16:07:23.722884Z",
			"updated_at": "2026-04-10T02:00:04.72726Z",
			"deleted_at": null,
			"main_name": "Inception Framework",
			"aliases": [
				"ATK 116",
				"Blue Odin",
				"Clean Ursa",
				"Cloud Atlas",
				"G0100",
				"Inception Framework",
				"Operation Cloud Atlas",
				"Operation RedOctober",
				"The Rocra"
			],
			"source_name": "ETDA:Inception Framework",
			"tools": [
				"Lastacloud",
				"PowerShower",
				"VBShower"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434641,
	"ts_updated_at": 1775792187,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9b0a95180c51fe4c587c02c2249e8ee3159b32f0.pdf",
		"text": "https://archive.orkl.eu/9b0a95180c51fe4c587c02c2249e8ee3159b32f0.txt",
		"img": "https://archive.orkl.eu/9b0a95180c51fe4c587c02c2249e8ee3159b32f0.jpg"
	}
}