Loading malware…
Ladon is a modular Chinese-language post-exploitation, internal-network scanning, and lateral-movement framework implemented primarily for Windows environments. It provides asset discovery, host and service enumeration, port scanning, web fingerprinting, password auditing, vulnerability detection, exploitation, credential access, privilege escalation, remote command execution, and shell acquisition. Supported remote-execution mechanisms include SMB, WMI, scheduled tasks, SSH, and web shells. Its credential-access functions include recovery of system credential material, VPN credentials, DPAPI-protected data, browser passwords, and browser cookies.
Ladon supports PowerShell-based execution, Cobalt Strike integration, reflective or in-memory loading, and extensibility through .NET assemblies, native DLLs, and PowerShell plugins. It includes modules for local and domain privilege escalation, token manipulation, service creation, port forwarding, reverse shells, and network scanning across a broad set of enterprise protocols. A cross-platform variant, LadonGo, has been described as supporting Linux, macOS, ARM and MIPS systems, routers, and network devices.
Ladon has been used by Chinese-speaking threat actors, including Earth Kurma, for reconnaissance and lateral movement. In observed intrusions targeting government and telecommunications organizations in Southeast Asia, it employed reflective loading and XOR-decoded payloads to reduce detection opportunities. It has also been observed in compromises of South Korean web-server environments, where attackers used it for privilege escalation, Microsoft SQL Server targeting, and lateral movement. Ladon is a dual-use offensive toolkit whose extensive post-compromise functionality makes it useful for unauthorized internal penetration and expansion after initial access.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
28 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
Ladon 大型内网渗透扫描器 Cobalt Strike插件内存加载 Ladon大型内网渗透扫描器\域渗透\横向工具,PowerShell模块、Cobalt Strike插件、内存加载、无文件扫描。
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earth Kurma conducted lateral movement using several tools: NBTSCAN, LADON, FRPC, WMIHACKER and ICMPinger. LADON demonstrated evasiveness by using a reflective loader.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
171 CiscoPwd…密码读取… 188 FortiGate CVE-2022-40684 未授权写SSH-KEY… 191 CVE-2018-14847…密码读取
171 CiscoPwd… 路由器密码读取… 191 CVE-2018-14847…密码读取… 199 JoomlaPwd…数据库密码读取
183 Firefox密码\Cookie\历史记录读取… 185 GetPwd支持Navicat、TeamView、Xshell、SecureCRT密码读取
远程执行命令包含(smbexec/wmiexe/psexec/atexec/sshexec/webshell)… 099… PSEXEC远程执行命令
高危漏洞检测… 漏洞利用… 一键GetShell… Weblogic漏洞利用… Tomcat漏洞利用… ZeroLogon… noPac
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ladon is a penetration testing and exploitation framework that supports scanning, privilege escalation, credential theft, and lateral movement. It is often abused by attackers for post-exploitation activities.
M-Trends 2023 ... Ladon ...
A lateral-movement and post-exploitation tool wrapped in a PyInstaller-compiled reflective loader, with per-sample XOR keys for payload obfuscation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.