Loading malware…
JuicyPotato is a publicly available, open-source Windows local privilege-escalation tool widely abused during post-compromise operations. It exploits Windows token impersonation permissions, notably SeImpersonatePrivilege, to elevate execution from service-account contexts to NT AUTHORITY\SYSTEM. Attackers use it to execute commands and launch additional tools with elevated privileges, particularly after compromising Microsoft IIS web servers or Microsoft SQL Server systems.
JuicyPotato is commonly deployed after initial access and executed through web shells or other attacker-controlled processes. Blue Mockingbird has used it to elevate from IIS application-pool accounts to SYSTEM, and it has also appeared in operations involving Lazarus, Earth Lamia, UAT-7237, UAT-10147, and Manic Menagerie. Its observed use spans web-hosting and IT providers, government environments, and other enterprise servers; it is not specific to a single threat actor or industry.
Attackers distribute precompiled binaries and incorporate the tool into customized execution chains. Observed adaptations include a Themida-packed version used by Lazarus and a VOIDMAW-packaged version used by Earth Lamia for in-memory execution. JuicyPotato's principal role is privilege escalation rather than initial infection, persistence, credential collection, or command-and-control communication.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Table 14 lists “JuicyPotato.exe” under “Privilege escalation” among binaries and scripts from the threat actors’ CNE tooling repository.
We found the actor packaged an entire binary of "JuicyPotato" into the DLL file with "VOIDMAW".
Talos observed the threat actor utilizing multiple “Potato” family tools to achieve system level privileges. While some of these tools, such as GodPotato and JuicyPotato, were downloaded as pre compiled binaries from the internet...
The malware generated by the w3wp.exe process, usopriv.exe is the JuicyPotato malware packed with Themida. The Potato malware strains are responsible for privilege escalation.
To escalate privileges, the attackers deployed known open-source tools, such as JuicyPotato.
To escalate privileges, the attackers deployed known open-source tools, such as JuicyPotato.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
T1588.002 — Obtain Capabilities: Tool (Resource Development)
The following is a list of commands executed by the threat actor using JuicyPotato installed in infected systems. The whoami command was used to check if privilege escalation had occurred correctly.
Earth Lamia packages its hacking tools into DLL files to launch them via DLL sideloading.
Performing privilege escalation using tools such as "GodPotato" and "JuicyPotato"
If you possess SeImpersonatePrivilege, the path to SYSTEM is guaranteed. You simply upload a tool like PrintSpoofer or JuicyPotato, execute it, and hijack a SYSTEM token.
SeImpersonatePrivilege (“ Impersonate a client after authentication ”) allows a thread to impersonate any access token through SetThreadToken() , ImpersonateLoggedOnUser() , or CreateProcessWithToken() .
You will run sudo -l and find that the www-data user can run tar, awk, less, or find as root without a password... If you possess SeImpersonatePrivilege, the path to SYSTEM is guaranteed.
The DLL file ... was named "mscoree.dll," which is one of the libraries loaded by "AppLaunch.exe".
If you possess SeImpersonatePrivilege, the path to SYSTEM is guaranteed. You simply upload a tool like PrintSpoofer or JuicyPotato, execute it, and hijack a SYSTEM token.
SeImpersonatePrivilege (“ Impersonate a client after authentication ”) allows a thread to impersonate any access token through SetThreadToken() , ImpersonateLoggedOnUser() , or CreateProcessWithToken() .
Earth Lamia packages its hacking tools into DLL files to launch them via DLL sideloading.
Execute it in memory with the “Assembly.Load” approach.
Using Potato exploits , a family of well-known local privilege-escalation techniques ... that abuse these privileges by coercing SYSTEM-level COM/RPC authentication back to an attacker-controlled listener
Intercepting NTLM or Kerberos authentication by using techniques such as coercion, relay attacks, or credential capture
The whoami command was used to check if privilege escalation had occurred correctly.
You simply upload a tool like PrintSpoofer or JuicyPotato... If initial access is gained, immediately upload SharpHound to map the domain attack paths.
Intercepting NTLM or Kerberos authentication by using techniques such as coercion, relay attacks, or credential capture
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.