Loading malware…
LaZagne is a publicly available, open-source credential-recovery and dumping tool widely abused for post-compromise credential theft. It retrieves stored usernames and passwords from sources including web browsers, email applications, databases, and Wi-Fi configurations, and can recover credential material from memory. Its cross-platform capabilities have been used in Windows intrusions and Linux-based cloud and container attacks. LaZagne is a dual-use utility rather than an inherently malicious application.
LaZagne has been used by espionage actors including APT15, APT33, Inception, Leafminer, MuddyWater, and OilRig, as well as ransomware operators and affiliates associated with Akira, LockBit, Ransom Cartel, and Storm-2570. TeamTNT incorporated it into the Chimaera campaign to expand credential harvesting in compromised cloud environments. Attackers typically deploy it after obtaining access, collecting credentials that can support subsequent privilege escalation and access to additional systems. Its use spans multiple industries and is not specific to a single threat actor or infection vector.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
21 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
LaZagne can perform credential dumping from memory to obtain account and password information.
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
They also started employing LaZagne, another open-source application, to enhance their credential-stealing capabilities.
Inception has obtained and used open-source tools such as LaZagne.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Akira threat actors use tools like Mimikatz and LaZagne to dump credentials.
APT15 uses widely accessible tools like Mimikatz and LaZagne (T1003.001, T1003.004, T1003.005).
The actor then tried to dump User Account credentials via SAM database.
APT15 uses widely accessible tools like Mimikatz and LaZagne (T1003.001, T1003.004, T1003.005).
APT15 uses widely accessible tools like Mimikatz and LaZagne (T1003.001, T1003.004, T1003.005).
The main goal of the group is to spy on its infected targets and steal information such as passwords, documents, browser cookies, email credentials and more.
T1552.001 Credential in Files ... This EQL query uses the process.entity_id field to detect a process accessing multiple sensitive files in a short period of time.
Adversaries may search the Registry on compromised systems for insecurely stored credentials... Example commands to find Registry keys related to password information: Local Machine Hive: reg query HKLM /f password /t REG_SZ /s Current User Hive: reg query HKCU /f password /t REG_SZ /s
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
107 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential-theft tool identified as part of the Akira intrusion toolkit. The article does not provide tool-specific execution details.
Credential-recovery tool explicitly described as used for credential dumping by Akira operators, contributing to credential exposure that must be addressed during incident recovery.
Credential-recovery tooling used by Storm-2570 to obtain credentials during its post-compromise operations.
Credential-harvesting tool used by Storm-2570 during ransomware intrusions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.