Loading malware…
Laplas is a lightweight C++ reverse shell for Windows used to provide interactive command execution on compromised systems. It connects to an external command-and-control server, launches the Windows command interpreter with redirected pipes, and relays commands and their output between the operator and the infected host. Identified variants support TLS-encrypted communications and incorporate debugger detection and XOR-based obfuscation.
Laplas is used by UAT-6275, also tracked as TAG-193, in activity overlapping the Silent Lynx threat cluster. These operations target government organizations across Central Asia and the wider Commonwealth of Independent States, including institutions responsible for diplomacy, economic development, agriculture, environmental management, and energy. The associated campaigns use spear-phishing messages and official-looking regional documents as lures, sometimes delivered through compromised government email accounts. Laplas serves as a post-compromise remote-access component alongside other custom reverse shells.
The reverse shell should not be conflated with the separately documented Laplas Clipper, a cryptocurrency-address replacement trojan distributed through criminal malware delivery chains.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
These attacks lead to the deployment of custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell, facilitating interactive remote access to compromised hosts.
Нападите доведуваат до инсталирање прилагодени обратни школки (Reverse Shell), како што се FoalShell, Chvost, Laplas и PickleShell.
Нападите доведуваат до инсталирање прилагодени обратни школки (Reverse Shell), како што се FoalShell, Chvost, Laplas и PickleShell.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Once launched, it spawns a hidden cmd.exe session and pipes command input and output to 45[.]130[.]146[.]197:80.
The actor’s GitHub-hosted PowerShell reverse shell (456.ps1) initiates an outbound TCP connection to this listener and executes commands received from the server.
During the April-May 2026 campaign wave, we identified a new C#/.NET reverse shell that supports SSL/TLS encryption for its C2 channel.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.