ctrlINT What the industry said about every indicator, with the quote

LPEClientMalware

  • lpeclienttea

LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to store the downloaded payload.From MISP Galaxy

Last reported 3 days ago, by Kaspersky Securelist2 reports

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1021.001Remote Desktop Protocol

    “…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”

    Sekoia.ioVendor
  2. T1195Supply Chain Compromise

    “Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”

    Sekoia.ioVendor
  3. T1543.003Windows Service

    “…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”

    Kaspersky SecurelistVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “After launching the second time, TechHub deployed another pair, ClientHub and LPEClient, rather than executing Cubridge directly.”

    Kaspersky SecurelistVendor
    Operation FlashHole: Lazarus breaks security, defies control

  2. “…it switched to malicious ISO files instead of ZIP files to evade detection, and used new malicious programs or variants, like MISTPEN, LPEClient, RollMid, and CookiePlus.”

    Sekoia.ioVendor
    Cyber Threat Actors Impacting the Financial Sector in 2024

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with LPEClient here?
No account needed. We do not store your IP address.