LaZagneMalware
The author described LaZagne as an open source project used to retrieve lots of passwords stored on a local computer. It has been developed for the purpose of finding these passwords for the most commonly-used software. It is written in Python and provided as compiled standalone binaries for Linux, Mac, and Windows.From MISP Galaxy
Last reported 22 days ago, by Huntress3 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“In addition, lateral movement was enabled by leveraging Remote Desktop Protocol.”
- T1003.001LSASS Memory
“CISA's advisory documents Akira operators dumping credentials with Mimikatz and LaZagne, pulling them from LSASS memory, and running Kerberoasting against service accounts.”
- T1053.005Scheduled Task
“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
- T1098Account Manipulation
“…Agent along with MeshCentral as an operational bridge between initial hands-on-keyboard activity and later-stage actions, such as account manipulation, discovery, credential access, security tampering, and ransomware deployment.”
- T1110Brute Force
“This fact is very important from the TTPs perspective: on rare occasions, the initial access is gained through a brute force attack against public-facing RDP-servers or just using valid accounts obtained from a third party.”
- T1110.003Password Spraying
“It’s important to note that the RaaS affiliates rarely perform brute force or password spraying attacks against such instances themselves, rather they buy accesses from the brokers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
The First 24 Hours: What Happens When Ransomware Lands“CISA's advisory documents Akira operators dumping credentials with Mimikatz and LaZagne, pulling them from LSASS memory, and running Kerberoasting against service accounts.”
-
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments“For credential access and harvesting, Storm-2570 uses tools like Mimikatz, LaZagne, and pypykatz.”
-
REvil Twins: Ransomware-as-a-Service program“This allowed affiliates to use very common and easy-detectable tools for credential dumping, such as Mimikatz and LaZagne.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.